@mrciphersmith/keryx 0.3.111 → 0.3.113
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +17 -3
- package/THIRD_PARTY_NOTICES.md +56 -0
- package/dist/cli.js +102938 -97144
- package/dist/core.js +6072 -4676
- package/package.json +3 -1
- package/src/gdgraph/affected-report.ts +14 -4
- package/src/gdgraph/build.ts +12 -9
- package/src/gdgraph/core-sources.ts +1 -0
- package/src/gdgraph/data-dir.ts +14 -0
- package/src/gdgraph/enrich.ts +5 -3
- package/src/gdgraph/query.ts +3 -2
- package/src/gdgraph/staleness.ts +8 -1
- package/src/gdgraph/wiki-layer.ts +9 -6
- package/src/gdskills/bundled/skills/orchestration/flow-orchestrator/SKILL.md +3 -3
- package/src/gdskills/bundled/skills/orchestration/job-orchestrator/SKILL.md +3 -3
- package/src/gdskills/bundled/skills/orchestration/job-orchestrator/orchestrator-prompt.md +2 -2
- package/src/gdskills/bundled/skills/orchestration/task-implementer/SKILL.md +4 -4
- package/src/gdskills/bundled/skills/planning/autodoc-orchestrator/SKILL.md +1 -1
- package/src/gdskills/bundled/skills/planning/interviewer/SKILL.md +3 -3
- package/src/gdskills/bundled/skills/quality/api-truth/SKILL.md +2 -2
- package/src/gdskills/bundled/skills/quality/deprecation-path/SKILL.md +3 -3
- package/src/gdskills/bundled/skills/quality/fresh-eyes/SKILL.md +2 -2
- package/src/gdskills/bundled/skills/quality/perf-check/SKILL.md +1 -1
- package/src/gdskills/bundled/skills/quality/root-cause/SKILL.md +2 -2
- package/src/gdskills/bundled/skills/review/review-architecture/SKILL.md +14 -15
- package/src/gdskills/bundled/skills/review/review-backend/SKILL.md +14 -14
- package/src/gdskills/bundled/skills/review/review-frontend/SKILL.md +13 -16
- package/src/gdskills/bundled/skills/review/review-logic/SKILL.md +14 -14
- package/src/gdskills/bundled/skills/review/review-orchestrator/SKILL.detail.md +42 -3
- package/src/gdskills/bundled/skills/review/review-orchestrator/SKILL.md +21 -19
- package/src/gdskills/bundled/skills/review/review-orchestrator/reviewer-finding.schema.json +16 -0
- package/src/gdskills/bundled/skills/review/review-orchestrator/reviewer-input.schema.json +47 -0
- package/src/gdskills/bundled/skills/review/review-orchestrator/templates/pr-comment-frontend.md +1 -1
- package/src/gdskills/bundled/skills/review/review-performance/SKILL.md +13 -13
- package/src/gdskills/bundled/skills/review/review-regression/SKILL.md +23 -25
- package/src/gdskills/bundled/skills/review/review-security-code/SKILL.md +13 -15
- package/src/gdskills/bundled/skills/review/review-testing-practices/SKILL.md +31 -57
|
@@ -192,20 +192,11 @@ pass, then work the checklist.
|
|
|
192
192
|
|
|
193
193
|
### Shared laws (every reviewer)
|
|
194
194
|
|
|
195
|
-
1. **A claim of runtime harm with no reproducible path is `info`.** If you cannot
|
|
196
|
-
|
|
197
|
-
|
|
198
|
-
|
|
199
|
-
|
|
200
|
-
pattern because it is often wrong elsewhere.
|
|
201
|
-
3. **One finding per class, not one per occurrence.** When the same shape appears
|
|
202
|
-
at several sites, report it once and list every site. Ten findings that are one
|
|
203
|
-
finding hide the other nine problems.
|
|
204
|
-
|
|
205
|
-
Severity levels are defined once, in `review-orchestrator/SKILL.md` →
|
|
206
|
-
**Severity (canonical)**. This reviewer does not restate them: `blocker` is the
|
|
207
|
-
four merge-blocking shapes named there and nothing else, and the `major`/`minor`
|
|
208
|
-
boundary is the trigger-and-outcome test.
|
|
195
|
+
1. **A claim of runtime harm with no reproducible path is `info`.** If you cannot name the input, call, or condition that reaches the code, you have an observation, not a finding. Report it as `info` and say what would settle it.
|
|
196
|
+
2. **Never flag the theoretical.** The path you describe must exist in the code under review. Do not report a safe API because it could be misused, or a pattern because it is often wrong elsewhere.
|
|
197
|
+
3. **One finding per class, not one per occurrence.** When the same shape appears at several sites, report it once and list every site. Ten findings that are one finding hide the other nine problems.
|
|
198
|
+
|
|
199
|
+
Severity levels are defined once, in `review-orchestrator/SKILL.md` → **Severity (canonical)**. This reviewer does not restate them: `blocker` is the four merge-blocking shapes named there and nothing else, and the `major`/`minor` boundary is the trigger-and-outcome test.
|
|
209
200
|
|
|
210
201
|
---
|
|
211
202
|
|
|
@@ -219,15 +210,9 @@ When dispatched by `review-orchestrator`, follow the provided `reviewer-input.sc
|
|
|
219
210
|
|
|
220
211
|
### Class scope — required for `blocker` and `major`
|
|
221
212
|
|
|
222
|
-
Every `blocker` and `major` finding must carry `class_scope`: **every** site that
|
|
223
|
-
holds the shape you found, and **how you enumerated them** — the grep or query
|
|
224
|
-
you ran, or the guard that derives the set.
|
|
213
|
+
Every `blocker` and `major` finding must carry `class_scope`: **every** site that holds the shape you found, and **how you enumerated them** — the grep or query you ran, or the guard that derives the set.
|
|
225
214
|
|
|
226
|
-
A finding anchored to one `file:line` is a claim about one site. The recorded
|
|
227
|
-
history of this repository is that a fix then repairs that site and leaves its
|
|
228
|
-
siblings: one writer of five, one operator instruction of four, six readers of
|
|
229
|
-
eight. Each was found by the *next* review round, which is why reviews here have
|
|
230
|
-
run to seven and four rounds instead of one.
|
|
215
|
+
A finding anchored to one `file:line` is a claim about one site. The recorded history of this repository is that a fix then repairs that site and leaves its siblings: one writer of five, one operator instruction of four, six readers of eight. Each was found by the *next* review round, which is why reviews here have run to seven and four rounds instead of one.
|
|
231
216
|
|
|
232
217
|
```yaml
|
|
233
218
|
class_scope:
|
|
@@ -235,12 +220,9 @@ class_scope:
|
|
|
235
220
|
enumeration_method: "grep for the config-path resolvers; 7 writers, 2 unguarded"
|
|
236
221
|
```
|
|
237
222
|
|
|
238
|
-
"I checked the others" is not an enumeration method. A single-entry `sites` list
|
|
239
|
-
is a claim that the class has exactly one member — make it deliberately, because
|
|
240
|
-
`review-finding.schema.json` accepts it and the next round tests it.
|
|
223
|
+
"I checked the others" is not an enumeration method. A single-entry `sites` list is a claim that the class has exactly one member — make it deliberately, because `review-finding.schema.json` accepts it and the next round tests it.
|
|
241
224
|
|
|
242
|
-
`minor` and `info` may omit it: enumerating the class for every low-severity
|
|
243
|
-
observation is theatre, not rigour.
|
|
225
|
+
`minor` and `info` may omit it: enumerating the class for every low-severity observation is theatre, not rigour.
|
|
244
226
|
|
|
245
227
|
```markdown
|
|
246
228
|
### [F-NNN] Title
|
|
@@ -252,9 +234,7 @@ observation is theatre, not rigour.
|
|
|
252
234
|
- **Fix**: concrete test rewrite or fixture/handler change
|
|
253
235
|
```
|
|
254
236
|
|
|
255
|
-
Severity comes from **Severity (canonical)** in `review-orchestrator/SKILL.md`.
|
|
256
|
-
This reviewer keeps no rubric of its own; what follows is where its recurring
|
|
257
|
-
conditions land under that rubric.
|
|
237
|
+
Severity comes from **Severity (canonical)** in `review-orchestrator/SKILL.md`. This reviewer keeps no rubric of its own; what follows is where its recurring conditions land under that rubric.
|
|
258
238
|
|
|
259
239
|
| Condition | Severity | Why, under the canonical rubric |
|
|
260
240
|
|---|---|---|
|
|
@@ -266,22 +246,11 @@ conditions land under that rubric.
|
|
|
266
246
|
| Substrate choice, smoke tagging, locator priority, co-location | `minor` | The suite is correct; the cost is to whoever maintains it |
|
|
267
247
|
| A convention preference with no effect on determinism or signal | `info` | Shared laws 1 and 2 |
|
|
268
248
|
|
|
269
|
-
A flaky test is `major`, not `blocker`: it wastes time, but it does not ship a
|
|
270
|
-
defect. A test that cannot fail does — which is why it is the one `blocker` here.
|
|
249
|
+
A flaky test is `major`, not `blocker`: it wastes time, but it does not ship a defect. A test that cannot fail does — which is why it is the one `blocker` here.
|
|
271
250
|
|
|
272
|
-
The three mutation-pass rows sit at `minor` deliberately, and the reasoning is
|
|
273
|
-
the canonical rubric rather than modesty: a coverage gap names no runtime trigger
|
|
274
|
-
and no user-visible outcome, so it cannot be `major` under the boundary test. What
|
|
275
|
-
makes them worth reporting is not severity but **evidence class** — each one is a
|
|
276
|
-
command that ran, which is the rarest thing in a review and the only kind of
|
|
277
|
-
finding a later round cannot argue away. Report them with the mutation and its
|
|
278
|
-
result, and they survive adjudication intact. Report them as "coverage looks
|
|
279
|
-
thin" and they are correctly discarded.
|
|
251
|
+
The three mutation-pass rows sit at `minor` deliberately, and the reasoning is the canonical rubric rather than modesty: a coverage gap names no runtime trigger and no user-visible outcome, so it cannot be `major` under the boundary test. What makes them worth reporting is not severity but **evidence class** — each one is a command that ran, which is the rarest thing in a review and the only kind of finding a later round cannot argue away. Report them with the mutation and its result, and they survive adjudication intact. Report them as "coverage looks thin" and they are correctly discarded.
|
|
280
252
|
|
|
281
|
-
The moment a surviving mutation is accompanied by a **reachable input that makes
|
|
282
|
-
the unpinned code do the wrong thing**, that is a separate finding at the severity
|
|
283
|
-
its own outcome earns — usually `major`. The coverage gap and the defect are two
|
|
284
|
-
findings, not one, and conflating them loses whichever the adjudicator disbelieves.
|
|
253
|
+
The moment a surviving mutation is accompanied by a **reachable input that makes the unpinned code do the wrong thing**, that is a separate finding at the severity its own outcome earns — usually `major`. The coverage gap and the defect are two findings, not one, and conflating them loses whichever the adjudicator disbelieves.
|
|
285
254
|
|
|
286
255
|
---
|
|
287
256
|
|
|
@@ -303,17 +272,22 @@ findings, not one, and conflating them loses whichever the adjudicator disbeliev
|
|
|
303
272
|
|
|
304
273
|
Report done only once all of these hold:
|
|
305
274
|
|
|
306
|
-
- The mutation table is published in full, survivors and casualties both, or the
|
|
307
|
-
|
|
308
|
-
-
|
|
309
|
-
|
|
310
|
-
-
|
|
311
|
-
|
|
312
|
-
|
|
313
|
-
|
|
314
|
-
|
|
315
|
-
|
|
316
|
-
|
|
317
|
-
|
|
318
|
-
|
|
275
|
+
- The mutation table is published in full, survivors and casualties both, or the report says which command failed and that the pass was skipped.
|
|
276
|
+
- The report states the cap: how many added or previously-requested gates were mutated and how many were not reached.
|
|
277
|
+
- Every finding names `file:line` and the evidence that settles it — the mutation and its result, the producer line, or the selector that names the branch.
|
|
278
|
+
- Every `blocker` and `major` carries `class_scope` with `sites` and an `enumeration_method` naming the search that produced them.
|
|
279
|
+
- No finding invents a severity: each lands under **Severity (canonical)** in `review-orchestrator/SKILL.md`, and a coverage gap is filed separately from any defect it exposes.
|
|
280
|
+
- The reply is the `REVIEW_RESULT` the Orchestrated Review Contract asks for, or `NEEDS_CONTEXT` naming the context that was missing — never a guess in its place.
|
|
281
|
+
|
|
282
|
+
<!-- keryx:layers-block:start -->
|
|
283
|
+
## Project layers: graph, tests, wiki, memory
|
|
284
|
+
|
|
285
|
+
Your payload may carry a `layers` block for your files: the files the graph says are affected, symbol neighbours, related tests, the wiki pages that describe the files and the memory entries for their module. It is bounded, and `truncated` names what was cut and the command that fetches the rest. When the diff alone does not settle a question, ask the project. Each command below is read-only and calls no model.
|
|
286
|
+
|
|
287
|
+
- `keryx gdgraph affected <file>`: who depends on the file. Use it before you call a change contained, and whenever a changed export, signature or behaviour may have callers outside your files.
|
|
288
|
+
- `keryx test related <file>`: the tests that cover the file. Use it before you say a behaviour is untested, and to judge whether a test would fail if the code broke.
|
|
289
|
+
- `keryx wiki ask "<q>"`: what the project wiki says a module is for and which rules bind it. Use it when the intent of the code is unclear and the diff does not state it.
|
|
290
|
+
- `keryx memory search "<q>"`: recorded lessons, decisions and known mistakes. Use it before you report a pattern the project may already have decided on, and when a failure looks like one it has seen.
|
|
319
291
|
|
|
292
|
+
In a review package, `keryx gdgraph affected <file> --data-dir <package>/layers/graph` reads the graph built at the PR head; the tracked graph may be from another commit. A finding still rests on the code you read: what a layer says is a lead, not evidence. If a layer is empty or a command fails, say so in the report instead of guessing.
|
|
293
|
+
<!-- keryx:layers-block:end -->
|