@maci0/dsh-cordis-review 0.17.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Marcel W. Wysocki
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,126 @@
+# dsh-cordis-review
+
+CORDIS review skills in the composer. `/cordis-review` patches context-paradigm violations. `/cordis-doc-review` creates or repairs source-backed tutorials, references, cookbooks, subsystem docs, and package contracts.
+
+```
+/cordis-review
+/cordis-doc-review
+```
+
+Paper: [A Programming Paradigm for Spatiotemporal Composability](https://arxiv.org/abs/2608.25512) (Shi, Zhang, Cui; arXiv:2608.25512).
+
+## What you get
+
+- **Two commands, one product.** `/cordis-review` and `/cordis-doc-review` load their bundled skill bodies through the skill registry and land in the `/` menu, DSH's command surface for user-invocable skills. Workspace defaults to the current one; `/cordis-review <path>` scopes it.
+- **Rubrics that ship with the plugin.** `skills/cordis-review/SKILL.md` audits temporal and spatial composability. `skills/cordis-doc-review/SKILL.md` creates accurate tutorials, references, cookbooks, subsystem docs, and package contracts from source, tests, and configuration.
+- **Patches, not advice.** The skill instructs the agent to fix every applicable hit, grep the callers of anything it touches, fix the shared primitive, and leave one dispose test per registration it adds or repairs. Hits outside the system boundary are skipped with a one-line reason.
+- **A closed-form checker.** `cordis-review-check` prints the four tags that are grammar rather than judgment: `mix-export`, `inject`, `toplevel`, `id`. Every tag is an ast-grep query over JS/TS/TSX, JavaScript/JSX, Python, and YAML.
+- **A real fallback path.** No `ast-grep` on PATH means each covered file warns on stderr and yields an LLM-fallback hit for the review agent to judge. `leak`, `inverse`, `hmr`, and `boundary` stay with the agent by design.
+- **Honest frontmatter handling.** Skill frontmatter is parsed with `yaml`, so block scalars and nested maps behave as the registry expects. The documented invocation keys (`user-invocable`, `disable-model-invocation`) and `whenToUse` project into the registry's summary; unknown keys stay in `metadata`.
+
+On DeepSeek Harness and `dsh-*` plugins the paper maps onto existing names: `ctx.effect`, `inject`, `ctx.get`, `apply`, HMR-safety tests.
+
+## Install
+
+> **Install it as a bundle.** `dsh plugin add …` mounts the row from the
+> package's own patch layer, which is what the settings editor can write to. A
+> row added with `--patch` is an overlay: it disappears at the next start.
+
+```sh
+dsh plugin --profile web add @maci0/dsh-cordis-review@0.17.1
+```
+
+This installs the public npm package; no GitHub token or `~/.secrets` setup is needed.
+The version is pinned. To upgrade, run the same command with a newer version,
+then restart `dsh web` (bundle layers compose at boot).
+
+The package declares `dsh.bundle` and ships a built `lib/`, so `dsh plugin add` activates its layer. Do not also paste the `id: cordis-review` row into your profile's `cordis.patch.yml`: `insert` does not dedupe ids, so the plugin would mount twice.
+
+Uninstall with the **package name**:
+
+```sh
+dsh plugin --profile web remove @maci0/dsh-cordis-review
+```
+
+Use the package name without a version when removing it; pnpm resolves the argument as a dependency key.
+
+Skill-only install, without the plugin row (DSH already watches `~/.dsh/skills`):
+
+```sh
+mkdir -p ~/.dsh/skills
+ln -s /path/to/dsh-cordis-review/skills/cordis-review ~/.dsh/skills/cordis-review
+```
+
+Edits then load on the next `/cordis-review`. A user- or project-level skill of the same name outranks the bundled copy. The symlinked skill's directory has no `lib/` beside it, so run its closed-form step as `node /path/to/dsh-cordis-review/lib/cli.js [scope]`.
+
+## Commands
+
+| Command | What it runs |
+|---|---|
+| `/cordis-review` | Reviews the current workspace against CORDIS and implements every applicable fix. |
+| `/cordis-review <path>` | Same audit, scoped to `<path>`. |
+| `cordis-review-check [root]` | Prints `file:line: tag: message` per closed-form hit, or `cordis-check: clean`. The package exposes it as the `cordis-review-check` bin. |
+
+Checker flags:
+
+- `-h`, `--help`: prints the usage.
+
+The ast-grep engine is auto-detected. With the binary on PATH, covered files get the closed-form pass; without it, every covered file warns on stderr and takes the LLM-fallback path.
+
+Exit status: **0** clean, **1** findings, **2** usage, path, or ast-grep error, or an incomplete scan. An unknown flag, a root that is not an existing directory, or an `ast-grep scan` that fails (non-zero exit, no JSON array) exits 2 with a one-line `cordis-check:` message on stderr. A directory the walk cannot list (permissions, a race with a delete) is never skipped silently: each one gets a `cordis-check: cannot read <dir>: <reason>` line on stderr, findings from the readable part still print, and the run exits 2 instead of claiming `clean`, since nothing under that directory was checked.
+
+## Configure
+
+None. The Loader row carries no `config`. The only knobs are the skill frontmatter keys:
+
+| Key | Default | Meaning |
+|---|---|---|
+| `name` | directory name | Kebab-case skill name; must be valid or the file is skipped. |
+| `description` | none | Required. Empty description means the skill is skipped with a warning. |
+| `whenToUse` | unset | Extra routing hint, projected into the registry summary. |
+| `disable-model-invocation` | `false` | `true` keeps the model from invoking the skill on its own. |
+| `user-invocable` | `true` | `false` removes `/cordis-review` from the command surface. |
+
+Both invocation keys take the spellings the harness accepts: a YAML boolean, `1`/`0`, or `yes`/`no`/`on`/`off`/`true`/`false` in any case. Any other value, or a legacy camelCase key (`userInvocable`, `modelInvocable`, `disableModelInvocation`), skips the skill with a warning. Provider-specific keys survive in `metadata`. One broken skill file is skipped with a warning; it never costs the catalog its other skills. Warnings go to the host logger (`ctx.logger.warn`), prefixed `[cordis-review]`.
+
+## How it works
+
+1. **Scope:** the current workspace, or the path argument.
+2. **Get the rules:** the skill's own checklist, plus the repo's `AGENTS.md` / `docs/cordis-primer.md` in DSH workspaces.
+3. **Map the runtime:** context object, effect primitives, entrypoints, loader.
+4. **Closed-form pass:** run the checker first.
+5. **Audit, then fix:** each hit becomes a code change unless it is a documented outside-boundary emission.
+6. **Verify:** dispose the contributing fiber and assert the contribution is gone; re-run the checker.
+
+A clean checker is not a pass. The runtime does not prove that an inverse actually reverts, or that operations published at one key commute. Those are author obligations, and this review discharges them in code.
+
+## Limits
+
+- **The checker proves four tags, nothing more.** It is not a correctness oracle and not a substitute for the checklist. Inverse, leak, HMR, and boundary findings come from the agent's judgment.
+- **Without `ast-grep`, every covered file becomes a judgment call.** Install the binary for deterministic results.
+- **The paper is not fetched by default, and the PDF is not usable.** The abs page is the one fetchable URL; the checklist in the skill body is the rubric.
+- **Host source edits remount only with `id: hmr` enabled** and this checkout in `config.root`. There is no browser chrome.
+
+## Development
+
+TypeScript built to `lib/`; bun runs the tests from source, so no build is needed to test. dsh loads plugins on Node `^22.19.0 || >=24.0.0`; development and tests run on bun.
+
+```sh
+bun install --frozen-lockfile
+bun test            # tests/*.test.ts
+bun run typecheck   # tsc -p tsconfig.json (no emit)
+bun run build       # tsc -p tsconfig.build.json -> lib/
+bun run check       # scan this checkout (runs the built lib/cli.js)
+```
+
+Coverage: every checker tag against real fixtures, CLI flag parsing, help, and each non-zero exit, frontmatter block scalars and chomping, skill discovery tolerating a broken sibling, abort settling promptly, and a real Cordis composition that mounts the skill provider and disposes it.
+
+For local development, install the checkout as a bundle:
+
+```sh
+dsh plugin --profile <name> add <path-to-checkout>
+```
+
+## Licence
+
+MIT. Review criteria derived from arXiv:2608.25512; the paper is not redistributed.

package/cordis.patch.yml

@@ -0,0 +1,10 @@
+# The dsh-cordis-review bundle patch: applied automatically when a profile
+# lists this bundle (`dsh plugin add`/`update` appends the package to
+# dsh.profile.bundles). Users override this row from their profile's own
+# cordis.patch.yml (live-watched; dsh.profile.bundles is frozen at boot) with a
+# `- id: cordis-review` row, which replaces the row's whole `config`.
+# Do not also insert this same row into the profile patch: insert does not
+# dedupe ids, and a second row would register the plugin twice.
+- insert:
+    - id: cordis-review
+      name: '@maci0/dsh-cordis-review'

package/icon.svg

@@ -0,0 +1,5 @@
+<svg width="36" height="36" viewBox="0 0 36 36" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <rect x="8" y="6" width="16" height="22" rx="2" fill="#E8F1FF" stroke="#145AF3" stroke-width="1.6"/>
+  <path d="M12.6 17.2l2.3 2.3 5-5.2" stroke="#145AF3" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M26.5 24.5l4 4" stroke="#145AF3" stroke-width="2.2" stroke-linecap="round"/>
+</svg>