@mrciphersmith/keryx 0.2.97 → 0.2.99

package/src/gdskills/bundled/skills/review/review-logic/SKILL.md

@@ -9,12 +9,12 @@ description: |
   NOT for: security vulnerabilities, performance profiling, style/naming preferences,
   or architectural pattern concerns — those belong in their respective specialized reviewers.
 triggers:
-  - "review logic"
+  - "logic review"
+  - "bug review"
+  - "correctness"
   - "check correctness"
   - "are there any bugs"
   - "check this for bugs"
-  - "logic review"
-  - "dispatched by review-orchestrator"
 metadata:
   author: "MrCipherSmith"
   version: "1.0.0"
@@ -64,7 +64,7 @@ Logic Review Progress:
 
 ## Scope Detection
 
-See shared script: `skills/shared/git-merge-base.md`
+See shared script: `.metaproject/skills/gdskills/shared/git-merge-base.md`
 
 Run the script to determine `BASE_SHA`, then collect the diff:
 
@@ -200,7 +200,7 @@ earlier review round, because there the finding is recorded as closed and is not
 
 ## Orchestrated Review Contract
 
-When dispatched by `review-orchestrator`, follow the provided `reviewer-input.schema.json` payload. Return a `REVIEW_RESULT` object compatible with `skills/review/review-orchestrator/reviewer-finding.schema.json`, then a concise markdown summary. Keep findings evidence-based, include concrete `suggested_fix` for every blocker/major, and return `NEEDS_CONTEXT` instead of guessing when required context is missing.
+When dispatched by `review-orchestrator`, follow the provided `reviewer-input.schema.json` payload. Return a `REVIEW_RESULT` object compatible with `.metaproject/skills/gdskills/review/review-orchestrator/reviewer-finding.schema.json`, then a concise markdown summary. Keep findings evidence-based, include concrete `suggested_fix` for every blocker/major, and return `NEEDS_CONTEXT` instead of guessing when required context is missing.
 
 ---
 

package/src/gdskills/bundled/skills/review/review-orchestrator/SKILL.md

@@ -1,36 +1,16 @@
 ---
 name: review-orchestrator
-description: |
-  Use when: a code review is requested and the user does not explicitly name a specialized reviewer.
-  Handles "review", "code review", "review PR", "review --frontend", "review --backend",
-  "review --architecture", "review --security", "review --performance", "review --style",
-  "review --verify", "review --project-conventions", "review --legacy-profiles", "review --all". Routes to specialized reviewers in parallel and
-  consolidates findings into one unified report.
-  NOT for: running a single specialized reviewer — invoke it directly by name instead.
+description: 'Use when: a code review is requested and the user does not name a specialized reviewer — "review", "code review", "review this PR", "review --all". Dispatches the relevant specialized reviewers in parallel and consolidates their findings into one unified report, and owns the fan-out flags "--all", "--project-conventions" and "--legacy-profiles". NOT for: running a single specialized reviewer — invoke it directly by name instead, which is also how a flag that names one domain reaches its reviewer.'
 triggers:
   - "review"
-  - "code review"
+  - "ревью"
+  - "review code"
+  - "full review"
+  - "review changes"
   - "review PR"
-  - "review --frontend"
-  - "review --backend"
-  - "review --architecture"
-  - "review --security"
-  - "review --performance"
-  - "review --style"
-  - "review --verify"
   - "review --all"
-  - "review --clean-code"
-  - "review --highload"
   - "review --project-conventions"
-  - "review --frontend-conventions"
-  - "review --testing-practices"
-  - "review --core-boundaries"
-  - "review --flow-graph"
   - "review --legacy-profiles"
-  - "review --code-ai"
-  - "review --learned"
-  - "review --code-style"
-  - "review --mobx-store"
 metadata:
   author: "MrCipherSmith"
   version: "1.9.0"
@@ -87,10 +67,11 @@ code — and it is the step that was documented as running for a whole release
 while nothing called it.
 
 The command names no model. It ranks whatever your provider reports at runtime
-and places the tiers relative to your own model; when it cannot rank anything it
-prints `inherit: true` and exits 0, which means the dispatch runs on the session
-model. That is a correct answer, not a failure — never "fix" it by writing a
-model id into a dispatch.
+and places the tiers relative to your own model; when ranking fails it still
+names the session's own provider and model as a fallback. Only when the session
+itself has no provider/model to name does it print `inherit: true` and exit 0,
+which means the dispatch runs on the session model. That is a correct answer,
+not a failure — never "fix" it by writing a model id into a dispatch.
 
 ---
 
@@ -160,7 +141,7 @@ which of its inputs were recovered and which were never written down.
 | `context_doc` | string | no | Path to job context document (e.g., `.metaproject/jobs/<job>/ai/context.md`). |
 | `context_mode` | string | no | `none`, `light`, or `full`. Default: `light` for PR review, `none` for small path reviews. `full` may call `context-collector` before dispatch. |
 | `token_budget` | object | no | Optional budget controls: `{total, per_reviewer, diff_max_chars, file_max_chars}`. |
-| `model_strategy` | string | no | `current`, `ask`, or `adaptive`. Default: `current`; do not switch models unless user or automation allows it. |
+| `model_strategy` | string | no | `ask` or `adaptive`. Default: `adaptive`; the model per dispatch is computed by `keryx review tier`, never chosen by hand (see Step 6). |
 | `managed_review` | object | no | Optional managed review mode: `{mode, target, target_ref, flow_id, reviewers}` where mode is `lightweight`, `attach-review`, `review-flow`, or `ingest`. |
 | `verification_mode` | string | no | `off`, `annotate`, or `filter`. Default `annotate` — verdicts are recorded and nothing is removed. See Wave C. |
 | `pr_comments` | object | no | `{enabled, max_replies_total, max_sentences_per_reply}`. Defaults: enabled when a PR exists, `30`, `2`. Collect every round, reply once at the end. See External PR comments. |
@@ -454,7 +435,7 @@ not ask for our reasoning and is reading between other tasks.
 
 ## Review Context Pack
 
-Before routing reviewers, build a compact `review_context` object. This is the shared source of truth for all sub-agents and must follow `skills/review/review-orchestrator/review-context.schema.json`.
+Before routing reviewers, build a compact `review_context` object. This is the shared source of truth for all sub-agents and must follow `.metaproject/skills/gdskills/review/review-orchestrator/review-context.schema.json`.
 
 Required content:
 - Request: raw user request, flags, review mode, explicit paths or commit range.
@@ -646,27 +627,31 @@ Default budget guidance:
 | small | <= 5 files and <= 300 changed lines | `light` | full relevant diff to selected reviewers |
 | medium | <= 20 files or <= 2,000 changed lines | `light` | per-domain filtered diff |
 | large | > 20 files or > 2,000 changed lines | ask `full` | staged waves by domain |
-| high-risk | auth/API/core/security/data migrations | ask `full` | include strict synthesis |
+| high-risk | auth/API/core/security/data migrations | ask `full` | staged waves, verifier included |
 
 ---
 
 ## Model Strategy
 
-Default: keep the current model for all reviewers.
+The model for each dispatch is computed, not chosen — see Step 6. Before every
+reviewer dispatch, run `keryx review tier` with the signals you hold and paste
+the `model` block it prints into that dispatch. Do not assign a model class by
+reading a table or by hand; that mechanical step is exactly what the command
+replaced (see Step 6 above and `job-orchestrator` Step 5, which pins the same
+rule: `model_strategy: "current"` is gone).
 
-If the platform supports assigning models to sub-agents and the user/automation allows it, the orchestrator may use `model_strategy: adaptive`:
+`model_strategy` now governs only how the *computed* model is surfaced, not
+whether it is computed:
 
-| Complexity | Suggested model class | Reviewers |
-|---|---|---|
-| simple | cheaper/faster coding model | `review-style`, `review-clean-code`, docs-only convention checks, legacy/profile checks |
-| normal | current/default model | `review-frontend`, `review-backend`, `review-testing-practices`, convention reviewers |
-| complex | strongest available coding/reasoning model | `review-logic`, `review-architecture`, `review-security-code`, `review-highload`, strict synthesis |
+| `model_strategy` | Behavior |
+|---|---|
+| `ask` | Present the `keryx review tier` model plan once before dispatch. |
+| `adaptive` (default) | Dispatch on the computed model directly; record the chosen model per reviewer in the final report metadata. |
 
 Rules:
-- Do not silently change model class when `model_strategy` is `current`.
-- With `model_strategy: ask`, present the model plan once before dispatch.
-- With `model_strategy: adaptive`, record chosen model class per reviewer in the final report metadata.
-- If model assignment is unsupported, record `model_strategy: current-session`.
+- Never write a model id into a dispatch by hand — paste the `model` block `keryx review tier` printed.
+- When the session has no provider/model to name it prints `inherit: true` and exits 0; that means the dispatch runs on the session model. Record that as `model_assignment: unsupported`, not as a failure.
+- With `model_strategy: ask`, present the model plan once before dispatch, then proceed with the computed model.
 
 ---
 
@@ -782,7 +767,7 @@ Before anything else, determine whether the request is **diff mode** or **path m
 
 ### Diff Mode
 
-See shared script: `skills/shared/git-merge-base.md`
+See shared script: `.metaproject/skills/gdskills/shared/git-merge-base.md`
 
 Run the script to determine `BASE_SHA`, then let the pre-filter build the scope:
 
@@ -1158,10 +1143,10 @@ Skipped reviewers:
 | `--verify` | `review-verifier`, AFTER all others; checks the consolidated findings by running something. Delete-only. |
 | (auto) | detected from diff file extensions — see Auto-detection table |
 
-Multiple flags may be combined. Example: `review --backend --security` dispatches
-`review-logic` + `review-backend` + `review-architecture` + `review-security-code`.
-Example: `review --frontend --frontend-conventions` dispatches the generic frontend set plus the
-local frontend conventions reviewer.
+Multiple flags may be combined: `review --backend --security` dispatches `review-logic` + `review-backend` + `review-architecture` + `review-security-code`; `review --frontend --frontend-conventions` dispatches the generic frontend set plus the local frontend conventions reviewer.
+
+This table applies once this skill is running; reaching it is a separate question. The router strips `--`, so `review --style` is the same phrase as `review-style`'s own `style review` trigger and goes straight there — the same destination this table names, and likewise for `--architecture`, `--security` and `--performance`. Only `--all`, `--project-conventions` and `--legacy-profiles` name this orchestrator, which is why they are its triggers.
+`--frontend` and `--backend` are the exception: this table fans each out to three reviewers, but a bare `review --frontend` reaches `review-frontend` alone, because `review frontend` and `frontend review` are one phrase to the router and that phrase is the specialist's — two skills may not share a trigger token set (`src/gdskills/catalog-single-source.test.ts`). Ask by name, or use `review --all`, when you want the three-reviewer fan-out; `docs/skills/rejected-skill-changes.md` records the alternatives that were measured and rejected.
 
 ---
 
@@ -1312,7 +1297,7 @@ Runtime rules:
 
 Do not use vague fallback messages such as "running through available agent types" without naming which reviewers used fallback and why.
 
-Pass each sub-reviewer a payload matching `skills/review/review-orchestrator/reviewer-input.schema.json`:
+Pass each sub-reviewer a payload matching `.metaproject/skills/gdskills/review/review-orchestrator/reviewer-input.schema.json`:
 
 ```yaml
 review_context: <bounded context pack>
@@ -1320,7 +1305,7 @@ reviewer: <skill-name>
 scope_mode: diff | path
 context_doc: <path or empty>
 issue_url: <url or empty>
-model_class: simple | normal | complex | current-session
+model: <the `model` block `keryx review tier` printed for this dispatch — paste verbatim>
 budget:
   max_prompt_tokens: <number or null>
   max_findings: <number>
@@ -1335,7 +1320,7 @@ target_path: <resolved path or file list>
 file_contents: <bounded file contents relevant to this reviewer>
 ```
 
-Each reviewer must return a `REVIEW_RESULT` object matching `skills/review/review-orchestrator/reviewer-finding.schema.json`, followed by a concise markdown summary. The orchestrator must reject or normalize free-form reports before consolidation.
+Each reviewer must return a `REVIEW_RESULT` object matching `.metaproject/skills/gdskills/review/review-orchestrator/reviewer-finding.schema.json`, followed by a concise markdown summary. The orchestrator must reject or normalize free-form reports before consolidation.
 
 **Important for path mode:** instruct each reviewer to check the **entire file**, not just changes. The scope report should say "Path: `<TARGET_PATH>`" instead of a branch/merge-base.
 
@@ -1560,15 +1545,15 @@ Severity ordering for sort: `blocker` > `major` > `minor` > `info`.
 
 ### Model Metadata Rules
 
-`current-session` is a model assignment/runtime strategy, not a model name. Never render it as `model: current-session` or as the PR comment `Model` value.
+`unsupported` is a model-assignment outcome recorded when `keryx review tier` has no session provider/model to name (it prints `inherit: true`), not a model name. Never render it as `model: unsupported` or as the PR comment `Model` value.
 
 When writing review report metadata or a PR comment:
 1. Read `review_context.token_policy.model_plan`.
-2. Set `Model strategy` from `model_plan.strategy`.
+2. Set `Model strategy` from `model_plan.strategy` (`ask` or `adaptive`).
 3. Set `Current model` from the first available value: `model_plan.current_model`, detected tool output, current runtime model shown by the platform, or `unknown`.
-4. If `strategy` is `adaptive`, `economy`, or `per-group`, include model classes: `complex_model`, `normal_model`, and `simple_model` when known.
-5. If model assignment is unsupported and `strategy` is `current-session`, write `Model assignment: current session` and still write `Current model: <actual model or unknown>`.
-6. If the actual model is unknown, write `unknown`; do not substitute `current-session`.
+4. Record the model actually assigned per reviewer — the `tier` and (`provider`+`model` or `inherit`) from the `model` block `keryx review tier` printed for that dispatch — rather than a fixed set of classes; include `complex_model`, `normal_model`, and `simple_model` too when `model_plan` reports them.
+5. If model assignment is unsupported (the dispatch's `model` block carried `inherit: true`), write `Model assignment: unsupported` and still write `Current model: <actual model or unknown>`.
+6. If the actual model is unknown, write `unknown`; do not substitute `unsupported` or `inherit`.
 
 ---
 
@@ -1599,9 +1584,9 @@ STATUS: DONE | DONE_WITH_CONCERNS
 - Reviewers dispatched: <comma-separated list>
 - Changed files: <count>
 - Context mode: `<none | light | full>`
-- Model strategy: `<current | ask | adaptive | economy | per-group | current-session>`
+- Model strategy: `<ask | adaptive>`
 - Current model: `<actual current model id/name, or unknown>`
-- Model assignment: `<single current session | adaptive classes | per reviewer classes | unsupported>`
+- Model assignment: `<per-reviewer tier/model from each dispatch's \`model\` block | unsupported>`
 - Token budget: `<used/limit if known; omissions count>`
 
 ## Stats
@@ -1752,9 +1737,9 @@ here is the failure this rule names.
 | Field | Value |
 |---|---|
 | Orchestrator | `review-orchestrator` |
-| Model | `<actual current model id/name, or unknown; never current-session>` |
-| Model strategy | `<current | ask | adaptive | economy | per-group | current-session>` |
-| Model assignment | `<current session | adaptive classes | per reviewer classes | unsupported>` |
+| Model | `<actual current model id/name, or unknown; never inherit or unsupported>` |
+| Model strategy | `<ask | adaptive>` |
+| Model assignment | `<per-reviewer tier/model from each dispatch's \`model\` block | unsupported>` |
 | Agents run | `<reviewers actually dispatched, including fallback runtimes when used>` |
 | Available reviewers | `<all reviewers considered by the orchestrator for this repository/runtime, grouped briefly as generic/convention/project/legacy when useful>` |
 | Skipped reviewers | `<reviewers not dispatched with short reasons, e.g. no matching files, optional group not selected, unavailable native agent, PR number missing>` |
@@ -1794,9 +1779,9 @@ review_run_id: <stable id, e.g. pr-5462-2026-06-13T10-22-00Z>
 orchestrator: review-orchestrator
 verdict: <APPROVE | APPROVE_WITH_SUGGESTIONS | REQUEST_CHANGES>
 context_mode: <none | light | full>
-model_strategy: <current | ask | adaptive | economy | per-group | current-session>
+model_strategy: <ask | adaptive>
 current_model: <actual current model id/name, or unknown>
-model_assignment: <current session | adaptive classes | per reviewer classes | unsupported>
+model_assignment: <per-reviewer tier/model from each dispatch's `model` block | unsupported>
 agents:
   - <reviewer>
 scope:
@@ -1873,7 +1858,7 @@ Formatting rules for PR comments and AI artifacts:
 - `Skipped reviewers` must include short reasons from `review_context.routing.reasons`, `review_context.review_plan.skipped`, and dispatch/runtime compatibility checks.
 - If the list is long, keep `Agents run` complete and summarize `Available reviewers` / `Skipped reviewers` by group with counts plus notable names; put full details in the AI artifact when one is generated.
 - When `comment-and-ai-artifact` is selected, the PR comment meta section must include both `AI artifact` and `AI artifact description`; do not rely on the link alone.
-- In the metadata table, `Model` must be the actual model id/name. Put `current-session`, `adaptive`, or `per-group` under `Model strategy` / `Model assignment`, not under `Model`.
+- In the metadata table, `Model` must be the actual model id/name. Put `unsupported`, `adaptive`, or `ask` under `Model strategy` / `Model assignment`, not under `Model`.
 - If posting via CLI, write the body to a temp file and use `gh pr comment <pr-number> --body-file <file>`; never inline a large heredoc into shell history.
 
 ---

package/src/gdskills/bundled/skills/review/review-orchestrator/input-contract.schema.json

@@ -46,11 +46,10 @@
     "model_strategy": {
       "type": "string",
       "enum": [
-        "current",
         "ask",
         "adaptive"
       ],
-      "default": "current"
+      "default": "adaptive"
     },
     "token_budget": {
       "type": "object",

package/src/gdskills/bundled/skills/review/review-orchestrator/review-context.schema.json

@@ -364,12 +364,8 @@
             "strategy": {
               "type": "string",
               "enum": [
-                "current",
                 "ask",
-                "adaptive",
-                "economy",
-                "per-group",
-                "current-session"
+                "adaptive"
               ]
             },
             "current_model": {

package/src/gdskills/bundled/skills/review/review-orchestrator/reviewer-input.schema.json

@@ -7,7 +7,7 @@
     "review_context",
     "reviewer",
     "scope_mode",
-    "model_class",
+    "model",
     "budget"
   ],
   "properties": {
@@ -36,14 +36,58 @@
         "null"
       ]
     },
-    "model_class": {
-      "type": "string",
-      "enum": [
-        "simple",
-        "normal",
-        "complex",
-        "current-session"
-      ]
+    "model": {
+      "description": "The `model` block `keryx review tier` printed for this dispatch (Step 6) — pasted verbatim, never composed by hand. `tier` is the mechanical vocabulary the command emits (`light`/`standard`/`deep`), never a model name. `provider`/`model` are present when the command resolved a concrete model; `inherit: true` replaces them when it could not, meaning the dispatch runs on the caller's own model. Field naming matches `model` in `contracts/subagent-dispatch.schema.json` and the object `keryx review tier --json` prints under its own `model` key.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "tier",
+        "tier_reasons",
+        "tier_resolution",
+        "model_discovery"
+      ],
+      "properties": {
+        "tier": {
+          "type": "string",
+          "enum": [
+            "light",
+            "standard",
+            "deep"
+          ]
+        },
+        "tier_reasons": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          }
+        },
+        "provider": {
+          "type": "string",
+          "minLength": 1
+        },
+        "model": {
+          "type": "string",
+          "minLength": 1
+        },
+        "inherit": {
+          "type": "boolean",
+          "description": "Run this dispatch on the caller's own model. Present in place of `provider`/`model`, never alongside them, when `keryx review tier` could not resolve a concrete model."
+        },
+        "tier_resolution": {
+          "type": "string",
+          "enum": [
+            "discovered",
+            "session-ranked",
+            "session-fallback"
+          ]
+        },
+        "model_discovery": {
+          "type": "object",
+          "description": "What `keryx review tier` discovered and how it ranked it, as printed. Not re-validated field by field here — that contract lives in `contracts/subagent-dispatch.schema.json`.",
+          "additionalProperties": true
+        }
+      }
     },
     "budget": {
       "type": "object",

package/src/gdskills/bundled/skills/review/review-performance/SKILL.md

@@ -3,12 +3,12 @@ name: review-performance
 model_tier: standard
 description: "Use when a performance review is requested, checking for N+1 queries, unnecessary re-renders, memory leaks, missing indexes, large bundle imports, and synchronous blocking in changed code. NOT for security, logic correctness, style, or architecture."
 triggers:
-  - "review performance"
   - "performance review"
+  - "perf check"
+  - "slow"
   - "check for perf issues"
   - "perf review"
   - "check N+1"
-  - dispatched by review-orchestrator
 metadata:
   author: "MrCipherSmith"
   version: "1.0.0"
@@ -62,7 +62,7 @@ This skill focuses on **measurable or high-likelihood bottlenecks** only. Premat
 
 ## Scope Detection
 
-See shared script: `skills/shared/git-merge-base.md`
+See shared script: `.metaproject/skills/gdskills/shared/git-merge-base.md`
 
 Run the script from that file to determine `MERGE_BASE` (`BASE_SHA`) and `SCOPE` before proceeding.
 
@@ -235,6 +235,12 @@ boundary is the trigger-and-outcome test.
    frequency *is* the trigger shared law 1 asks for.
 2. **Do not flag patterns outside the diff.** Review only changed code. Legacy
    issues outside the diff are `info` at most, with a note to track separately.
+3. **An optimisation with no before/after is an unmeasured claim, and a neutral
+   one is a finding.** Ask what was measured and on what workload. No pair at all
+   is `minor` — unjustified, not wrong. A neutral pair is `major`, and the fix it
+   suggests is a revert: what counts as neutral under noise, and what the attempt
+   owes the journal, are `perf-check`'s Rules, not restated here. Writing that
+   entry is the author's job, not yours; a revert with no entry is its own `minor`.
 
 ---
 
@@ -340,11 +346,9 @@ Stop and re-read these rules if you are thinking:
 | Rationalization | Why it's wrong |
 |---|---|
 | "This loop iterates over user data, so N+1 is obviously a problem" | State the expected N and query cost; "user data" is not self-evidently large |
-| "I'll flag this as major because it looks slow" | Looking slow is not a hot path; cite the execution context |
 | "Missing useMemo here is a performance issue" | useMemo has overhead; only flag when the computation is measurably expensive or the component re-renders at high frequency |
-| "I'll add a minor finding for every lodash default import" | Correct — but only flag if the library is large and the import is demonstrably not tree-shaken |
 | "The dataset could grow large, so I'll call it a blocker" | "Could grow" = minor or info; known to be large = major or blocker |
-| "Skipping the hot-path citation to keep the finding concise" | Performance law 1: the hot path is mandatory for blocker/major; omitting it means downgrading to `info` |
+| "The optimisation measures neutral, but it does no harm — no reason to hold the diff" | The complexity it bought with no measured gain *is* the harm, and it passes review precisely because nothing in it is wrong. Neutral is `revert`, per performance law 3 |
 
 ---
 
@@ -365,10 +369,6 @@ If provided and the file exists, read the context document before starting the r
 
 If the file does not exist or is not provided, proceed normally — context is optional and non-blocking.
 
-
 ## Orchestrated Review Contract
 
-When dispatched by `review-orchestrator`, follow the provided `reviewer-input.schema.json` payload. Return a `REVIEW_RESULT` object compatible with `skills/review/review-orchestrator/reviewer-finding.schema.json`, then a concise markdown summary. Keep findings evidence-based, include concrete `suggested_fix` for every blocker/major, and return `NEEDS_CONTEXT` instead of guessing when required context is missing.
-
----
-
+When dispatched by `review-orchestrator`, follow the provided `reviewer-input.schema.json` payload. Return a `REVIEW_RESULT` object compatible with `.metaproject/skills/gdskills/review/review-orchestrator/reviewer-finding.schema.json`, then a concise markdown summary. Keep findings evidence-based, include concrete `suggested_fix` for every blocker/major, and return `NEEDS_CONTEXT` instead of guessing when required context is missing.

package/src/gdskills/bundled/skills/review/review-pr-feedback/SKILL.md

@@ -9,13 +9,14 @@ description: |
   NOT for: reviewing code directly — this skill reads human or bot PR feedback and
   makes it actionable. To review code, use the domain review skills.
 triggers:
-  - "analyze PR comments"
   - "review PR feedback"
+  - "analyze PR comments"
+  - "review comments"
+  - "fix PR comments"
   - "what did reviewers say"
   - "parse PR #N"
   - "explain PR comments"
   - "PR feedback"
-  - "fix PR comments"
   - "review-pr-feedback --fix"
 metadata:
   author: "MrCipherSmith"
@@ -80,8 +81,8 @@ review-pr-feedback Progress:
 | `comment_ids` | string[] | no | Restrict the run to these collected comment ids. Every excluded comment is listed with that reason. |
 | `max_fix_rounds` | integer | no | Sent in the Step 9 dispatch as an `attempt budget:` constraint. It only ever LOWERS the bound `flow-orchestrator` owns; omit it to take that skill's own. |
 
-Schemas: `skills/review/review-pr-feedback/input-contract.schema.json` and
-`skills/review/review-pr-feedback/output-contract.schema.json`. Nothing refuses a
+Schemas: `.metaproject/skills/gdskills/review/review-pr-feedback/input-contract.schema.json` and
+`.metaproject/skills/gdskills/review/review-pr-feedback/output-contract.schema.json`. Nothing refuses a
 dispatch that ignores them — no production code loads either file — so they are a
 contract between agents, and this skill validating its own output against the
 output schema is what makes them worth writing.
@@ -297,7 +298,7 @@ For each comment, classify intent before explaining:
 
 This maps the **intent of an incoming human comment**, which is not a code
 condition. It is not a second severity rubric: the levels themselves are defined
-once, in `skills/review/review-orchestrator/SKILL.md` → **Severity (canonical)**,
+once, in `.metaproject/skills/gdskills/review/review-orchestrator/SKILL.md` → **Severity (canonical)**,
 and a mapped value is a starting point that the canonical test overrides whenever
 the comment names a concrete trigger and outcome.
 
@@ -504,7 +505,7 @@ implementation loop of its own, and a second one would diverge from the one that
 is tested.
 
 Dispatch payload, conforming to
-`skills/orchestration/flow-orchestrator/input-contract.schema.json` — a registered
+`.metaproject/skills/gdskills/orchestration/flow-orchestrator/input-contract.schema.json` — a registered
 contract, so `keryx skills contracts validate <file> --schema flow-orchestrator-input`
 refuses a malformed one. Validate before dispatching.
 
@@ -539,13 +540,13 @@ criterion rather than by an author's assertion.
 ### The loop, and its bound
 
 The review→fix→review loop belongs to `flow-orchestrator`, and so does its exit
-threshold: `skills/orchestration/flow-orchestrator/SKILL.md` → **PR review/fix
+threshold: `.metaproject/skills/gdskills/orchestration/flow-orchestrator/SKILL.md` → **PR review/fix
 loop** defines it once, beside the bound. Do not restate the level here — the
 bound was centralised and the threshold was left copied four ways in the same
 edit, which is how one of them ends up stale while every guard stays green.
 
 The bound is defined once, in
-`skills/orchestration/flow-orchestrator/SKILL.md` → **PR review/fix loop**, along
+`.metaproject/skills/gdskills/orchestration/flow-orchestrator/SKILL.md` → **PR review/fix loop**, along
 with the evidence behind it and the `keryx review loop` repetition check that
 runs before any attempt is spent. Do not restate the number here: two copies of a
 bound are two things to edit when the evidence changes, and the copy nobody edits

package/src/gdskills/bundled/skills/review/review-regression/SKILL.md

@@ -10,8 +10,7 @@ description: |
 triggers:
   - "review regression"
   - "does this change break anything"
-  - "blast radius review"
-  - "dispatched by review-orchestrator"
+  - "blast radius"
 metadata:
   author: "MrCipherSmith"
   version: "1.0.0"
@@ -183,3 +182,35 @@ Severity levels are defined once, in `review-orchestrator/SKILL.md` →
 **Severity (canonical)**. This reviewer does not restate them: `blocker` is the
 four merge-blocking shapes named there and nothing else, and the `major`/`minor`
 boundary is the trigger-and-outcome test.
+
+---
+
+## Red Flags
+
+| Rationalization | Why it is wrong |
+|----------------|-----------------|
+| "This code in the blast radius is badly written, so I will say so." | Scope B asks one question, and it is not that one. The screen rejects it as `outside-set` or as `non-regression-severity`, and the round is spent on a finding nobody reads. |
+| "The caller might break." | Might is not a regression. Name the argument that is no longer passed, the type that narrowed, the branch that went away — or file nothing. Below `major` the screen rejects it by construction. |
+| "I will anchor the finding at the changed line, since that is the cause." | Scope A already reviewed that line. Anchor where the damage lands: the caller a human has to open is the one that breaks. |
+| "The blast radius came back empty, so the change breaks nothing." | An empty radius for a non-code change is recorded as unresolved, not clean. Say the radius could not answer the question — silence that reads as "nothing found" is the failure this lane was built to stop. |
+| "It is a `major` about a dependent and the anchor names the file, so the link to the change is obvious." | `no-link-to-change` is a substring match over your prose, and only a `blocker` is exempt from it. Name the changed file, module or symbol in the finding text or it is dropped before it reaches `findings.json`. |
+| "The set was capped, but I covered the important ones." | The cap is recorded. If files were dropped, say so in the summary; a report that implies a complete sweep over a truncated set is a false claim about coverage. |
+| "The change is only reached through a spawned process / a string-keyed lookup, so the graph must have missed it — I will report it anyway." | Report it, and say the graph could not see the edge. What you must not do is present a runtime path as if the computed set produced it. |
+
+---
+
+## Verification
+
+Report done only once all of these hold:
+
+- Every finding is anchored inside the computed set or the changed set, at the
+  code that **breaks** rather than the code that changed.
+- Every finding is `major` or above, and every `major` names the changed file,
+  module or symbol whose behaviour moved — the anchor alone does not carry it.
+- Every finding carries `class_scope` whose `sites` are the callers that break and
+  whose `enumeration_method` is the walk over the blast-radius set that produced
+  them.
+- The summary states whether the cap dropped files, and whether the radius could
+  answer the question at all for the shape of this change.
+- Nothing that is merely an observation about pre-existing code is filed here; it
+  is either raised under scope A or not at all.

package/src/gdskills/bundled/skills/review/review-security-code/SKILL.md

@@ -3,12 +3,14 @@ name: review-security-code
 model_tier: standard
 description: "Use when a code-level security review is requested, checking for injection vulnerabilities, auth gaps, insecure cryptography, secrets, and OWASP Top 10 patterns in changed code. NOT for infrastructure, deployment, or dependency audits."
 triggers:
-  - "review security"
   - "security review"
+  - "проверь безопасность"
+  - "безопасность кода"
+  - "secure code"
+  - "vulnerability"
   - "check for vulnerabilities"
   - "security check"
   - "OWASP review"
-  - dispatched by review-orchestrator
 metadata:
   author: "MrCipherSmith"
   version: "1.0.0"
@@ -61,7 +63,7 @@ This skill covers **code-level security only**. It does NOT audit npm/bun depend
 
 ## Scope Detection
 
-See shared script: `skills/shared/git-merge-base.md`
+See shared script: `.metaproject/skills/gdskills/shared/git-merge-base.md`
 
 Run the script from that file to determine `MERGE_BASE` (`BASE_SHA`) and `SCOPE` before proceeding.
 
@@ -373,7 +375,7 @@ If the file does not exist or is not provided, proceed normally — context is o
 
 ## Orchestrated Review Contract
 
-When dispatched by `review-orchestrator`, follow the provided `reviewer-input.schema.json` payload. Return a `REVIEW_RESULT` object compatible with `skills/review/review-orchestrator/reviewer-finding.schema.json`, then a concise markdown summary. Keep findings evidence-based, include concrete `suggested_fix` for every blocker/major, and return `NEEDS_CONTEXT` instead of guessing when required context is missing.
+When dispatched by `review-orchestrator`, follow the provided `reviewer-input.schema.json` payload. Return a `REVIEW_RESULT` object compatible with `.metaproject/skills/gdskills/review/review-orchestrator/reviewer-finding.schema.json`, then a concise markdown summary. Keep findings evidence-based, include concrete `suggested_fix` for every blocker/major, and return `NEEDS_CONTEXT` instead of guessing when required context is missing.
 
 ---
 

package/src/gdskills/bundled/skills/review/review-style/SKILL.md

@@ -8,11 +8,11 @@ description: |
   NOT for: logic bugs, architectural violations, security vulnerabilities, performance
   anti-patterns, or any finding that could cause a functional regression.
 triggers:
-  - "review style"
   - "style review"
+  - "readability"
+  - "clean up"
   - "check naming"
   - "check readability"
-  - "review --style"
 metadata:
   author: "MrCipherSmith"
   version: "1.0.0"
@@ -34,7 +34,7 @@ Never touches logic correctness, architecture, security, or performance.
 ```
 review-style Progress:
 - [ ] Step 1: Read Job Context (if CONTEXT_PATH provided)
-- [ ] Step 2: Determine git scope (merge-base) — see skills/shared/git-merge-base.md
+- [ ] Step 2: Determine git scope (merge-base) — see .metaproject/skills/gdskills/shared/git-merge-base.md
 - [ ] Step 3: Collect diff and changed file list
 - [ ] Step 4: Naming conventions check
 - [ ] Step 5: Dead code and imports check
@@ -60,7 +60,7 @@ review-style Progress:
 
 ## Scope Detection
 
-See shared script: `skills/shared/git-merge-base.md`
+See shared script: `.metaproject/skills/gdskills/shared/git-merge-base.md`
 
 Run that script to determine `BASE_SHA` before collecting the diff.
 
@@ -228,7 +228,7 @@ boundary is the trigger-and-outcome test.
 
 ## Orchestrated Review Contract
 
-When dispatched by `review-orchestrator`, follow the provided `reviewer-input.schema.json` payload. Return a `REVIEW_RESULT` object compatible with `skills/review/review-orchestrator/reviewer-finding.schema.json`, then a concise markdown summary. Keep findings evidence-based, include concrete `suggested_fix` for every blocker/major, and return `NEEDS_CONTEXT` instead of guessing when required context is missing.
+When dispatched by `review-orchestrator`, follow the provided `reviewer-input.schema.json` payload. Return a `REVIEW_RESULT` object compatible with `.metaproject/skills/gdskills/review/review-orchestrator/reviewer-finding.schema.json`, then a concise markdown summary. Keep findings evidence-based, include concrete `suggested_fix` for every blocker/major, and return `NEEDS_CONTEXT` instead of guessing when required context is missing.
 
 ---