@mrciphersmith/keryx 0.2.97 → 0.2.99

package/src/gdskills/bundled/skills/review/code-learned-review/SKILL.md

@@ -1,15 +1,16 @@
 ---
 name: code-learned-review
-description: "Reviews the current branch against conventions this project learned from its own pull-request comments, recorded in a local project skill. Ships with an empty checklist: the content comes from `keryx review learn`, never from the tool. Use when: a project has a learned review skill and wants its own accumulated conventions applied."
+description: "Use when a project has a learned review skill — built by `keryx review learn` from its own pull-request comments — and wants those accumulated conventions applied to the current branch. Ships with an empty checklist: the content comes from the project, never from the tool. NOT for: a project with no learned skill, or a review request that names no profile (review-orchestrator)."
 triggers:
   - "learned review"
+  - "code-learned-review"
   - "review with our conventions"
   - "review using what we learned"
 metadata:
   author: "keryx"
   version: "2.0.0"
   category: "review"
-  compatible_harnesses: "cursor,codex,zed,opencode"
+  compatible_harnesses: "cursor,codex,zed,opencode,claude"
 license: "MIT"
 ---
 
@@ -87,7 +88,7 @@ that is a supported state rather than an error.
 
 ## Scope Detection
 
-See shared script: `skills/shared/git-merge-base.md`
+See shared script: `.metaproject/skills/gdskills/shared/git-merge-base.md`
 
 Run the script from that file to determine MERGE_BASE and SCOPE before
 proceeding with the review.
@@ -241,3 +242,42 @@ review. Use it to:
 
 If the file does not exist or is not provided, proceed normally — context is
 optional and non-blocking.
+
+---
+
+## Red Flags
+
+This profile is a mechanism with an empty checklist, and it predates the finding
+contract the rest of the review domain now shares. Both facts produce their own
+failure modes, and they are the rows below.
+
+| Rationalization | Why it is wrong |
+|----------------|-----------------|
+| "This project has no learned skill, but I can review against sensible conventions." | An empty learned review is not a generic review. Say the project has no learned skill and stop; `review-orchestrator` is what a generic request wants. Inventing conventions here ships one model's taste as the team's agreed standard. |
+| "This lesson is about a slightly different case, but the spirit applies." | Do not generalise a lesson past its text. A lesson about one shape of function is about that shape; widening it into a rule about a layer or a language invents a convention the project never agreed to. |
+| "The lesson came from a named reviewer, so I will report it as what they would want." | Do not attribute. The record says a comment was left, nothing more. Reporting a finding as a person's preference turns the checklist back into the persona this skill exists to remove. |
+| "This pull-request comment is good even though the config does not name its author." | An author the config does not name contributes nothing — not to a proposal, not to a `SKILL.md`, and not to this review. Changing who counts is a config change, made deliberately, not a judgement call mid-review. |
+| "A lesson exists for this, so the finding stands." | A lesson is evidence, not authority. If the diff has a reason the original objection does not apply here, the reason wins and the finding is not raised. |
+| "The report has a Severity field, so it is a review result." | It is not. This profile predates `reviewer-finding.schema.json` and emits free prose with no machine-readable finding, so nothing downstream can screen, verify or deduplicate it. Hand it to a person, never to `keryx review ingest`. |
+| "The lessons I checked that matched nothing are not worth mentioning." | They are the only way anyone learns a lesson has gone stale. Record the count of lessons checked and the count that matched, either way. |
+
+---
+
+## Verification
+
+Report done only once all of these hold:
+
+- `.metaproject/review-learning.config.json` was read and the project skill it
+  names was opened. If that skill carries no lessons, the reply says so and stops
+  rather than reviewing generically.
+- The report states the project skill and version, the number of lessons checked
+  and the number that matched.
+- Every finding cites the line in the project skill it rests on. Findings with no
+  learned lesson behind them are listed in their own section and routed to the
+  reviewer that owns them.
+- No finding names a person, quotes a personal catchphrase, or reports a lesson as
+  somebody's preference.
+- The scope block carries the real branch, parent ref, merge-base and scope mode,
+  and every finding is anchored to a line the branch slice changed.
+- The report is free prose by design, so it is delivered to a person and is not
+  fed into the managed-review pipeline.

package/src/gdskills/bundled/skills/review/code-mobx-store-review/SKILL.md

@@ -1,15 +1,17 @@
 ---
 name: code-mobx-store-review
-description: "Targeted MobX store and state logic review. Checks store/actions/computed/reactions, async runInAction, state typing, View↔Store boundaries. Use when: reviewing MobX changes, state management validation."
+description: "Use when MobX store changes need a focused review — actions, computed values, reactions, async runInAction, state typing, and View↔Store boundaries. NOT for: a general frontend review (review-frontend) or a review request that names no domain (review-orchestrator)."
 triggers:
+  - "mobx review"
+  - "store review"
+  - "code-mobx-store-review"
   - "Review MobX store"
   - "Check store changes"
-  - "MobX review"
 metadata:
   author: "MrCipherSmith"
   version: "1.1.0"
   category: "review"
-  compatible_harnesses: "cursor,codex,zed,opencode"
+  compatible_harnesses: "cursor,codex,zed,opencode,claude"
   stack_requires: "mobx"
 license: "MIT"
 ---
@@ -31,7 +33,7 @@ license: "MIT"
 
 ## Scope Detection
 
-See shared script: `skills/shared/git-merge-base.md`
+See shared script: `.metaproject/skills/gdskills/shared/git-merge-base.md`
 
 Run the script from that file to determine MERGE_BASE and SCOPE before proceeding with the review.
 
@@ -257,3 +259,43 @@ If provided and the file exists, read the context document before starting the r
 - Avoid flagging intentional architectural decisions as issues
 
 If the file does not exist or is not provided, proceed normally — context is optional and non-blocking.
+
+---
+
+## Red Flags
+
+This profile is a thin legacy wrapper around `mobx-store-template.mdc`. It
+predates the shared finding contract, it does not use the review domain's
+severity vocabulary at all, and half of it is written in Russian — each of those
+is a way it misfires, and they are the rows below.
+
+| Rationalization | Why it is wrong |
+|----------------|-----------------|
+| "The checklist prints severities, so this report is a review result." | It is not. `Critical` / `Warnings` / `Suggestions` are section headings in a Markdown document, not a severity field: this profile predates `reviewer-finding.schema.json` and emits free prose with no machine-readable finding. Hand it to a person, never to `keryx review ingest`. |
+| "Half the instructions are in Russian, so the report should be." | The mixed language is an artefact of when this file was written. Write the report in the language the requester used. |
+| "The two stores sync both ways and I have not seen an infinite loop." | A bounce needs one ordering to appear, and reading the code is not running it. The checklist rates a bidirectional sync with no equality guard as **critical** for exactly that reason: the absence of the guard is the finding, not the absence of a reproduction. |
+| "`if (value && value !== other)` is the safer guard." | It is the guard that silently refuses to clear. `undefined`, `null`, `0` and `""` are legitimate values to propagate, and a truthy check strands the stale one instead. |
+| "The component's `useEffect` calls `store.init()` — that is ordinary React." | Not under this architecture. The parent store orchestrates its children's lifecycle, and moving that into a component is how `dispose()` stops being called and stale async writes start landing. |
+| "The method is only called by another store, so `@action.bound` is harmless." | The decorator publishes it. Inter-store callbacks and internal handlers are `private` here; the naming patterns the checklist lists are the tell, and the decision question is whether a React component calls it. |
+| "While I was in the store I also noticed naming and component problems." | The Scope Boundaries table routes those to `code-style-review` and `code-ai-review`. A finding filed under the wrong profile arrives without the checks that lane would have applied. |
+
+---
+
+## Verification
+
+Report done only once all of these hold:
+
+- The requester asked for this profile by name, or through
+  `review --legacy-profiles`. A general frontend or store review with no profile
+  named belongs to `review-orchestrator`.
+- The scope block carries the real branch, parent ref, merge-base and scope mode —
+  not the template placeholders.
+- Every entry carries Rule, Why, Where (path plus the lines from the diff) and
+  Fix, with a minimal unified diff where the fix is a line or two.
+- Every entry is anchored to a line the branch slice actually changed; legacy
+  store code outside that slice is not discussed.
+- Entries are sorted into this document's own Critical / Warnings / Suggestions
+  sections, and are not presented as a severity any other reviewer or tool
+  consumes.
+- The report is free prose by design, so it is delivered to a person and is not
+  fed into the managed-review pipeline.

package/src/gdskills/bundled/skills/review/code-style-review/SKILL.md

@@ -1,15 +1,14 @@
 ---
 name: code-style-review
-description: "Detailed code style and architecture review using code-style-patterns.mdc. Reviews current branch changes. Checks naming, organization, patterns, TypeScript usage. Use when: style validation needed, architecture review."
+description: "Use when the legacy code style and architecture review profile (code-style-patterns.mdc) is asked for by name — naming, organization, patterns, and TypeScript usage on the current branch. NOT for: a general style review (review-style) or an architecture review (review-architecture)."
 triggers:
-  - "Style review"
-  - "Check code style"
-  - "Architecture review"
+  - "code-style-review"
+  - "architecture style"
 metadata:
   author: "MrCipherSmith"
   version: "1.0.0"
   category: "review"
-  compatible_harnesses: "cursor,codex,zed,opencode"
+  compatible_harnesses: "cursor,codex,zed,opencode,claude"
 license: "MIT"
 ---
 
@@ -30,7 +29,7 @@ license: "MIT"
 
 ## Scope Detection
 
-See shared script: `skills/shared/git-merge-base.md`
+See shared script: `.metaproject/skills/gdskills/shared/git-merge-base.md`
 
 Run the script from that file to determine MERGE_BASE and SCOPE before proceeding with the review.
 
@@ -166,3 +165,44 @@ If provided and the file exists, read the context document before starting the r
 - Provide more accurate findings by understanding the project's architectural decisions
 
 If the file does not exist or is not provided, proceed normally — context is optional and non-blocking.
+
+---
+
+## Red Flags
+
+This profile is a thin legacy wrapper around `code-style-patterns.mdc`. It
+predates the shared finding contract, it does not use the review domain's
+severity vocabulary at all, and it is written mostly in Russian — each of those
+is a way it misfires, and they are the rows below.
+
+| Rationalization | Why it is wrong |
+|----------------|-----------------|
+| "A style review was asked for, so I will run this profile." | It is a legacy opt-in profile pinned to one rules file, reached by name or through `review --legacy-profiles`. A general style request belongs to `review-style`, and an architecture request to `review-architecture`; running this instead answers a narrower question than the one that was asked. |
+| "The report has a Critical section, so downstream can consume it." | It cannot. `Critical` / `Warnings` / `Suggestions` are headings in a Markdown document, not a severity field: this profile predates `reviewer-finding.schema.json` and emits free prose with no machine-readable finding. Hand it to a person, never to `keryx review ingest`. |
+| "The instructions are in Russian, so the report should be." | The language is an artefact of when this file was written. Write the report in the language the requester used. |
+| "`public` reads more clearly than leaving the modifier off." | The project's ESLint configuration forbids the keyword outright, at error level. That is a build failure, not a matter of taste, and a reviewer arguing the taste is arguing with a gate that already decided. |
+| "This component does not look like it reads observables, so the wrapper is optional." | Check what it reads through props and through the store getters it calls. Missing `observer` is rated critical in the checklist above because the failure is silent: the component simply stops updating. |
+| "The `any` is temporary — the author will type it properly later." | Nothing records that intent and nothing revisits it. Rate the code in the diff, and propose `unknown` plus a type guard as the concrete fix. |
+| "While reading for style I found a real bug, so I will report it here." | This report has nowhere to carry it and the requester is not reading it for that. Route it to `code-ai-review` (or `review-logic`) and say in one line that you did. |
+
+---
+
+## Verification
+
+Report done only once all of these hold:
+
+- The requester asked for this profile by name, or through
+  `review --legacy-profiles`. A style or architecture request that names no
+  profile belongs to `review-style` or `review-architecture`.
+- The scope block carries the real branch, parent ref, merge-base and scope mode —
+  not the template placeholders.
+- Every entry carries Rule (the section of `code-style-patterns.mdc` it rests on),
+  Why, Where (path plus the lines from the diff) and Fix, with a minimal unified
+  diff rather than an edit applied to the tree.
+- Every entry is anchored to a line the branch slice actually changed; legacy code
+  outside that slice is not discussed.
+- Entries are sorted into this document's own Critical / Warnings / Suggestions
+  sections, and are not presented as a severity any other reviewer or tool
+  consumes.
+- The report is free prose by design, so it is delivered to a person and is not
+  fed into the managed-review pipeline.

package/src/gdskills/bundled/skills/review/review-architecture/SKILL.md

@@ -8,12 +8,12 @@ description: |
   Dispatched by review-orchestrator with --architecture or --backend.
   NOT for: style/naming preferences, logic correctness bugs, or security vulnerabilities.
 triggers:
-  - "review architecture"
+  - "architecture review"
+  - "boundary review"
+  - "layering"
   - "check architecture"
   - "architectural review"
-  - "architecture review"
   - "check layers"
-  - "dispatched by review-orchestrator"
 metadata:
   author: "MrCipherSmith"
   version: "1.0.0"
@@ -61,7 +61,7 @@ Architecture Review Progress:
 
 ## Scope Detection
 
-See shared script: `skills/shared/git-merge-base.md`
+See shared script: `.metaproject/skills/gdskills/shared/git-merge-base.md`
 
 Run the script to determine `BASE_SHA`, then collect the diff:
 
@@ -210,7 +210,7 @@ Focus on **SRP** and **DIP** — the two most commonly violated in practice.
 
 ## Orchestrated Review Contract
 
-When dispatched by `review-orchestrator`, follow the provided `reviewer-input.schema.json` payload. Return a `REVIEW_RESULT` object compatible with `skills/review/review-orchestrator/reviewer-finding.schema.json`, then a concise markdown summary. Keep findings evidence-based, include concrete `suggested_fix` for every blocker/major, and return `NEEDS_CONTEXT` instead of guessing when required context is missing.
+When dispatched by `review-orchestrator`, follow the provided `reviewer-input.schema.json` payload. Return a `REVIEW_RESULT` object compatible with `.metaproject/skills/gdskills/review/review-orchestrator/reviewer-finding.schema.json`, then a concise markdown summary. Keep findings evidence-based, include concrete `suggested_fix` for every blocker/major, and return `NEEDS_CONTEXT` instead of guessing when required context is missing.
 
 ---
 

package/src/gdskills/bundled/skills/review/review-backend/SKILL.md

@@ -9,11 +9,10 @@ description: |
   (use review-security-code for XSS/injection/auth-bypass), or performance profiling
   (use review-performance).
 triggers:
-  - "review backend"
   - "backend review"
-  - "review API"
+  - "api review"
+  - "service review"
   - "review NestJS"
-  - "review --backend"
 metadata:
   author: "MrCipherSmith"
   version: "1.0.0"
@@ -36,7 +35,7 @@ performance checks — those belong to `review-security-code` and `review-perfor
 ```
 review-backend Progress:
 - [ ] Step 1: Read Job Context (if CONTEXT_PATH provided)
-- [ ] Step 2: Determine git scope (merge-base) — see skills/shared/git-merge-base.md
+- [ ] Step 2: Determine git scope (merge-base) — see .metaproject/skills/gdskills/shared/git-merge-base.md
 - [ ] Step 3: Collect diff and changed file list
 - [ ] Step 4: NestJS patterns check
 - [ ] Step 5: API design check
@@ -60,7 +59,7 @@ review-backend Progress:
 
 ## Scope Detection
 
-See shared script: `skills/shared/git-merge-base.md`
+See shared script: `.metaproject/skills/gdskills/shared/git-merge-base.md`
 
 Run that script to determine `BASE_SHA` before collecting the diff.
 
@@ -230,7 +229,7 @@ is, and a condition that cannot name one is not a `blocker`.
 
 ## Orchestrated Review Contract
 
-When dispatched by `review-orchestrator`, follow the provided `reviewer-input.schema.json` payload. Return a `REVIEW_RESULT` object compatible with `skills/review/review-orchestrator/reviewer-finding.schema.json`, then a concise markdown summary. Keep findings evidence-based, include concrete `suggested_fix` for every blocker/major, and return `NEEDS_CONTEXT` instead of guessing when required context is missing.
+When dispatched by `review-orchestrator`, follow the provided `reviewer-input.schema.json` payload. Return a `REVIEW_RESULT` object compatible with `.metaproject/skills/gdskills/review/review-orchestrator/reviewer-finding.schema.json`, then a concise markdown summary. Keep findings evidence-based, include concrete `suggested_fix` for every blocker/major, and return `NEEDS_CONTEXT` instead of guessing when required context is missing.
 
 ---
 

package/src/gdskills/bundled/skills/review/review-clean-code/SKILL.md

@@ -10,12 +10,12 @@ description: |
   NOT for: architectural layer violations (review-architecture), naming convention formatting
   (review-style), logic correctness bugs (review-logic), or security (review-security-code).
 triggers:
-  - "review clean code"
+  - "clean code review"
+  - "functions do too much"
+  - "solid review"
+  - "maintainability"
   - "check clean code"
   - "Uncle Bob review"
-  - "SOLID review"
-  - "review --clean-code"
-  - dispatched by review-orchestrator
 metadata:
   author: "MrCipherSmith"
   version: "1.0.0"
@@ -65,7 +65,7 @@ Clean Code Review Progress:
 
 ## Scope Detection
 
-See shared script: `skills/shared/git-merge-base.md`
+See shared script: `.metaproject/skills/gdskills/shared/git-merge-base.md`
 
 Run the script to determine `BASE_SHA`, then collect the diff:
 
@@ -398,7 +398,7 @@ Flags:
 
 ## Orchestrated Review Contract
 
-When dispatched by `review-orchestrator`, follow the provided `reviewer-input.schema.json` payload. Return a `REVIEW_RESULT` object compatible with `skills/review/review-orchestrator/reviewer-finding.schema.json`, then a concise markdown summary. Keep findings evidence-based, include concrete `suggested_fix` for every blocker/major, and return `NEEDS_CONTEXT` instead of guessing when required context is missing.
+When dispatched by `review-orchestrator`, follow the provided `reviewer-input.schema.json` payload. Return a `REVIEW_RESULT` object compatible with `.metaproject/skills/gdskills/review/review-orchestrator/reviewer-finding.schema.json`, then a concise markdown summary. Keep findings evidence-based, include concrete `suggested_fix` for every blocker/major, and return `NEEDS_CONTEXT` instead of guessing when required context is missing.
 
 ---
 

package/src/gdskills/bundled/skills/review/review-core-boundaries/SKILL.md

@@ -6,10 +6,14 @@ description: |
   direction, feature-boundary leakage, abstraction stability, composition,
   and blast-radius risks. Dispatched by review-orchestrator for
   --core-boundaries, --project-conventions, --all, or src/core/** changes.
+  NOT for: logic correctness in code that happens to live in core (review-logic),
+  naming and readability (review-style), or SOLID and layering inside a feature
+  module (review-architecture).
 triggers:
+  - "core review"
+  - "shared boundary"
+  - "public surface"
   - "review core boundaries"
-  - "review --core-boundaries"
-  - dispatched by review-orchestrator
 metadata:
   author: "MrCipherSmith"
   version: "1.0.0"
@@ -73,7 +77,7 @@ boundary is the trigger-and-outcome test.
 
 ## Orchestrated Review Contract
 
-When dispatched by `review-orchestrator`, follow the provided `reviewer-input.schema.json` payload. Return a `REVIEW_RESULT` object compatible with `skills/review/review-orchestrator/reviewer-finding.schema.json`, then a concise markdown summary. Keep findings evidence-based, include concrete `suggested_fix` for every blocker/major, and return `NEEDS_CONTEXT` instead of guessing when required context is missing.
+When dispatched by `review-orchestrator`, follow the provided `reviewer-input.schema.json` payload. Return a `REVIEW_RESULT` object compatible with `.metaproject/skills/gdskills/review/review-orchestrator/reviewer-finding.schema.json`, then a concise markdown summary. Keep findings evidence-based, include concrete `suggested_fix` for every blocker/major, and return `NEEDS_CONTEXT` instead of guessing when required context is missing.
 
 ---
 
@@ -127,3 +131,33 @@ conditions land under that rubric.
 
 "Broad blast radius" is not by itself a `blocker`. Name the consumer that breaks.
 
+---
+
+## Red Flags
+
+| Rationalization | Why it is wrong |
+|----------------|-----------------|
+| "It is generic enough to live in core." | Generic enough is not shared. Name the second consumer that needs it today; one feature's helper parked in core is exactly the leak this lane exists to catch, whatever the file is called. |
+| "Core has broad blast radius, so this is a `blocker`." | Blast radius is a property of the module, not of the change. Name the consumer that breaks and what breaks in it, or it is `info` under shared law 1. |
+| "It is only a type import, so core does not really depend on the feature." | The import is in the source and in the build graph. Delete the feature module and core stops compiling — direction is decided by what core names, not by what survives type erasure. |
+| "The new export has one consumer today, so the surface is still stable." | A public core export is a contract with every module that installs it. One consumer is the argument for keeping the helper internal, not for exporting it. |
+| "I cannot enumerate every consumer of a core symbol, so I will anchor the finding at the file the diff touched." | Consumers of a core export are precisely what a search enumerates. A `class_scope` with no `enumeration_method` is the one-site fix that leaves the siblings for the next round. |
+| "The move into core is temporary — it gets extracted properly later." | Nothing downstream records that intent, and a core import is load-bearing the moment it ships. Rate the code in the diff, not the plan described beside it. |
+
+---
+
+## Verification
+
+Report done only once all of these hold:
+
+- Every finding names `file:line` and the evidence that settles it — the import,
+  the export, or the consumer — quoted from the tree rather than described.
+- Every `blocker` and `major` carries `class_scope` with `sites` and an
+  `enumeration_method` naming the search that produced them.
+- No finding invents a severity: each lands under **Severity (canonical)** in
+  `review-orchestrator/SKILL.md`.
+- Every blast-radius claim names the consumer that breaks. Unnamed ones are
+  `info`, and say what would settle them.
+- The reply is the `REVIEW_RESULT` the Orchestrated Review Contract asks for, or
+  `NEEDS_CONTEXT` naming the context that was missing — never a guess in its place.
+

package/src/gdskills/bundled/skills/review/review-flow-graph/SKILL.md

@@ -7,10 +7,13 @@ description: |
   boundaries, selection lifecycle, and large-graph performance. Dispatched by
   review-orchestrator for --flow-graph, --project-conventions, --all, or
   src/core/flow/** / graph abstraction changes.
+  NOT for: React and MobX component structure outside the graph surface
+  (review-frontend), render cost elsewhere in the app (review-performance), or
+  the domain rules a graph happens to display (review-logic).
 triggers:
-  - "review flow graph"
-  - "review --flow-graph"
-  - dispatched by review-orchestrator
+  - "flow graph review"
+  - "graph ui review"
+  - "reactflow review"
 metadata:
   author: "MrCipherSmith"
   version: "1.0.0"
@@ -99,7 +102,7 @@ boundary is the trigger-and-outcome test.
 
 ## Orchestrated Review Contract
 
-When dispatched by `review-orchestrator`, follow the provided `reviewer-input.schema.json` payload. Return a `REVIEW_RESULT` object compatible with `skills/review/review-orchestrator/reviewer-finding.schema.json`, then a concise markdown summary. Keep findings evidence-based, include concrete `suggested_fix` for every blocker/major, and return `NEEDS_CONTEXT` instead of guessing when required context is missing.
+When dispatched by `review-orchestrator`, follow the provided `reviewer-input.schema.json` payload. Return a `REVIEW_RESULT` object compatible with `.metaproject/skills/gdskills/review/review-orchestrator/reviewer-finding.schema.json`, then a concise markdown summary. Keep findings evidence-based, include concrete `suggested_fix` for every blocker/major, and return `NEEDS_CONTEXT` instead of guessing when required context is missing.
 
 ---
 
@@ -152,3 +155,34 @@ conditions land under that rubric.
 | Internal helper reaching across a boundary with no observable consequence | `minor` | Correct today; the cost is to the next editor |
 | Surface concern with no named caller | `info` | Shared law 1 |
 
+---
+
+## Red Flags
+
+| Rationalization | Why it is wrong |
+|----------------|-----------------|
+| "The domain module imports the internal shell directly, but it renders fine." | Rendering is not the contract. The public graph surface is what the next refactor of the shell is allowed to change; a consumer reaching past it is the break waiting to happen, and it is reportable today. |
+| "Only one consumer needs this helper, so exporting it from the graph surface is harmless." | An export is a promise to every future consumer. The rule in the checklist is two consumers, and one is the argument for leaving the helper internal. |
+| "This graph felt slow when I read the code." | A performance claim here is a claim about a node and edge count. Name the count at which it degrades, or the finding is `info` under shared law 1. |
+| "Deep observation on the nodes array is fine — the library is fast." | The cost is proxying every node on every write, and it scales with the array, not with the library. If you are rating it, state the array size the diff can produce. |
+| "The subclass sets up its own reactivity first; base initialisation order is an implementation detail." | The base store's state is what the base selection, click and reset behaviour reads. Initialising after it is the documented lifecycle, not a style preference. |
+| "The layout ran, so the lifecycle is intact." | Selection, expand/collapse and reset each have their own lifecycle. A layout that completes says nothing about whether a domain side effect swallowed the base selection reset. |
+
+---
+
+## Verification
+
+Report done only once all of these hold:
+
+- Every finding names `file:line` and the evidence that settles it — the import,
+  the export, the subclass member, or the measured count.
+- Every `blocker` and `major` carries `class_scope` with `sites` and an
+  `enumeration_method` naming the search that produced them — for a surface
+  finding, every consumer of the symbol, not only the one in the diff.
+- Every performance finding states the node/edge count at which the cost applies;
+  without one it is `info`.
+- No finding invents a severity: each lands under **Severity (canonical)** in
+  `review-orchestrator/SKILL.md`.
+- The reply is the `REVIEW_RESULT` the Orchestrated Review Contract asks for, or
+  `NEEDS_CONTEXT` naming the context that was missing — never a guess in its place.
+

package/src/gdskills/bundled/skills/review/review-frontend/SKILL.md

@@ -3,13 +3,11 @@ name: review-frontend
 model_tier: standard
 description: "Use when a frontend review is requested, checking React component patterns, MobX state management (observer, actions, computed, reactions, lifecycle), View-Store boundaries, and TypeScript safety in changed frontend code. NOT for backend patterns, security vulnerabilities, performance bottlenecks, or cross-layer architecture."
 triggers:
-  - "review frontend"
   - "frontend review"
+  - "component review"
+  - "ui review"
   - "review React"
-  - "review MobX"
-  - "review store"
   - "review components"
-  - dispatched by review-orchestrator
 metadata:
   author: "MrCipherSmith"
   version: "1.1.0"
@@ -100,7 +98,7 @@ not a second opinion.
 
 ## Scope Detection
 
-See shared script: `skills/shared/git-merge-base.md`
+See shared script: `.metaproject/skills/gdskills/shared/git-merge-base.md`
 
 Run the script from that file to determine `MERGE_BASE` (`BASE_SHA`) and `SCOPE` before proceeding.
 
@@ -630,7 +628,7 @@ If the file does not exist or is not provided, proceed normally — context is o
 
 ## Orchestrated Review Contract
 
-When dispatched by `review-orchestrator`, follow the provided `reviewer-input.schema.json` payload. Return a `REVIEW_RESULT` object compatible with `skills/review/review-orchestrator/reviewer-finding.schema.json`, then a concise markdown summary. Keep findings evidence-based, include concrete `suggested_fix` for every blocker/major, and return `NEEDS_CONTEXT` instead of guessing when required context is missing.
+When dispatched by `review-orchestrator`, follow the provided `reviewer-input.schema.json` payload. Return a `REVIEW_RESULT` object compatible with `.metaproject/skills/gdskills/review/review-orchestrator/reviewer-finding.schema.json`, then a concise markdown summary. Keep findings evidence-based, include concrete `suggested_fix` for every blocker/major, and return `NEEDS_CONTEXT` instead of guessing when required context is missing.
 
 ---
 

package/src/gdskills/bundled/skills/review/review-frontend-conventions/SKILL.md

@@ -8,10 +8,14 @@ description: |
   styling tokens, Storybook expectations, and local tooling rules. Dispatched
   by review-orchestrator for --frontend-conventions, --project-conventions,
   --all, or frontend src/**/*.ts(x) changes when local convention docs exist.
+  NOT for: generic React and MobX correctness with no local rule behind it
+  (review-frontend), what the CSS actually renders (review-layout), or naming and
+  readability as a matter of taste (review-style).
 triggers:
+  - "frontend conventions"
+  - "local frontend rules"
+  - "CLAUDE frontend"
   - "review frontend conventions"
-  - "review --frontend-conventions"
-  - dispatched by review-orchestrator
 metadata:
   author: "MrCipherSmith"
   version: "1.0.0"
@@ -124,7 +128,7 @@ boundary is the trigger-and-outcome test.
 
 ## Orchestrated Review Contract
 
-When dispatched by `review-orchestrator`, follow the provided `reviewer-input.schema.json` payload. Return a `REVIEW_RESULT` object compatible with `skills/review/review-orchestrator/reviewer-finding.schema.json`, then a concise markdown summary. Keep findings evidence-based, include concrete `suggested_fix` for every blocker/major, and return `NEEDS_CONTEXT` instead of guessing when required context is missing.
+When dispatched by `review-orchestrator`, follow the provided `reviewer-input.schema.json` payload. Return a `REVIEW_RESULT` object compatible with `.metaproject/skills/gdskills/review/review-orchestrator/reviewer-finding.schema.json`, then a concise markdown summary. Keep findings evidence-based, include concrete `suggested_fix` for every blocker/major, and return `NEEDS_CONTEXT` instead of guessing when required context is missing.
 
 ---
 
@@ -177,3 +181,33 @@ conditions land under that rubric.
 | Naming, story coverage, file placement | `minor` | Correct today; the cost is to the next editor |
 | A convention preference with no named consequence | `info` | Shared laws 1 and 2 |
 
+---
+
+## Red Flags
+
+| Rationalization | Why it is wrong |
+|----------------|-----------------|
+| "There is no project guide here, but I know what good React looks like." | Then you are running the neutral baseline, and you must say so in the report. A preference with no local rule and no named consequence is `info`, not a convention violation — this lane's authority comes from the project's own documents. |
+| "The guide says one thing but the newer files all do another, so that is the convention." | A pattern repeated in code is a candidate convention, not a decision. Cite the guide and name the divergence; let the team choose which one moves. |
+| "The linter already fails on this, so it is at least `major`." | The machine catches it before merge. A reviewer restating a lint error spends a merge gate on something no human can ship past, which is why the rubric above puts it at `minor`. |
+| "It is one direct `localStorage` call — the wrapper is overkill here." | The wrapper exists because the raw API throws on quota and is absent in some environments. One unguarded call is the class; enumerate the others before deciding it is small. |
+| "This component does not read observables, so it does not need the reactive wrapper." | Check what it reads through props and through the store getters it calls. Lost reactivity is silent, which is why it is rated the same here as in `review-frontend`. |
+| "The inline `style` is dynamic, so the token rule does not reach it." | Only the computed part is dynamic. Colours and spacing inside it still come from the local tokens, and mixing the two is how a theme change stops applying to one surface. |
+
+---
+
+## Verification
+
+Report done only once all of these hold:
+
+- The report names which local convention documents were found and read, or
+  states plainly that none exist and only the neutral baseline ran.
+- Every finding cites the local rule it rests on — the guide, the lint config, or
+  the baseline section above — and names `file:line`.
+- Every `blocker` and `major` carries `class_scope` with `sites` and an
+  `enumeration_method` naming the search that produced them.
+- No finding invents a severity: each lands under **Severity (canonical)** in
+  `review-orchestrator/SKILL.md`.
+- The reply is the `REVIEW_RESULT` the Orchestrated Review Contract asks for, or
+  `NEEDS_CONTEXT` naming the context that was missing — never a guess in its place.
+

package/src/gdskills/bundled/skills/review/review-highload/SKILL.md

@@ -11,13 +11,11 @@ description: |
   (review-performance), clean code style (review-clean-code), or NestJS module structure
   (review-architecture).
 triggers:
-  - "review highload"
-  - "review scalability"
   - "highload review"
-  - "review concurrency"
+  - "concurrency review"
+  - "race condition"
+  - "review scalability"
   - "review distributed"
-  - "review --highload"
-  - dispatched by review-orchestrator
 metadata:
   author: "MrCipherSmith"
   version: "1.0.0"
@@ -68,7 +66,7 @@ High-Load Review Progress:
 
 ## Scope Detection
 
-See shared script: `skills/shared/git-merge-base.md`
+See shared script: `.metaproject/skills/gdskills/shared/git-merge-base.md`
 
 Run the script to determine `BASE_SHA`, then collect the diff:
 
@@ -405,7 +403,7 @@ Flags:
 
 ## Orchestrated Review Contract
 
-When dispatched by `review-orchestrator`, follow the provided `reviewer-input.schema.json` payload. Return a `REVIEW_RESULT` object compatible with `skills/review/review-orchestrator/reviewer-finding.schema.json`, then a concise markdown summary. Keep findings evidence-based, include concrete `suggested_fix` for every blocker/major, and return `NEEDS_CONTEXT` instead of guessing when required context is missing.
+When dispatched by `review-orchestrator`, follow the provided `reviewer-input.schema.json` payload. Return a `REVIEW_RESULT` object compatible with `.metaproject/skills/gdskills/review/review-orchestrator/reviewer-finding.schema.json`, then a concise markdown summary. Keep findings evidence-based, include concrete `suggested_fix` for every blocker/major, and return `NEEDS_CONTEXT` instead of guessing when required context is missing.
 
 ---
 

package/src/gdskills/bundled/skills/review/review-layout/SKILL.md

@@ -12,10 +12,9 @@ description: |
   naming and readability (review-style), re-render cost (review-performance), React or
   MobX structure (review-frontend).
 triggers:
-  - "review layout"
   - "layout review"
+  - "review layout"
   - "does this render correctly"
-  - "dispatched by review-orchestrator"
 metadata:
   author: "MrCipherSmith"
   version: "1.0.0"
@@ -175,7 +174,7 @@ where its recurring conditions land under that one.
 
 When dispatched by `review-orchestrator`, follow the provided
 `reviewer-input.schema.json` payload. Return a `REVIEW_RESULT` object compatible
-with `skills/review/review-orchestrator/reviewer-finding.schema.json`, then a
+with `.metaproject/skills/gdskills/review/review-orchestrator/reviewer-finding.schema.json`, then a
 concise markdown summary. Prefix finding ids `LY-`.
 
 ### Class scope — required for `blocker` and `major`
@@ -215,3 +214,25 @@ a claim that the class has exactly one member — make it deliberately.
 | "The class names look fine." | This lane does not review class names. That is `review-frontend-conventions`. |
 | "I could not run the visual tier, so I reasoned it out." | Then it is `info`, marked unverified. Reasoning does not become measurement by being careful. |
 | "RTL is handled, the component uses logical properties." | Check the gradients, shadows and transforms too. Those are the ones that do not flip. |
+
+---
+
+## Verification
+
+Report done only once all of these hold:
+
+- Every finding carries a **measurement**: the host width, the element width or
+  the offset in pixels, and the command or probe that produced it. An unmeasured
+  observation is filed as `info`, marked unverified, and says what would settle it.
+- The measurement was taken at the worst real case — the longest translation in
+  the catalog, the narrowest supported host, the state where the sibling is
+  absent — not at the convenient one.
+- Every finding names `file:line` on the component that renders the box.
+- Every `blocker` and `major` carries `class_scope` with `sites` and an
+  `enumeration_method` naming the search that derived the set of elements sharing
+  the sizing shape.
+- No finding invents a severity: each lands under **Severity (canonical)** in
+  `review-orchestrator/SKILL.md`.
+- The reply is the `REVIEW_RESULT` the Orchestrated Review Contract asks for, with
+  finding ids prefixed `LY-`, or `NEEDS_CONTEXT` naming the context that was
+  missing — never a guess in its place.