@mrciphersmith/keryx 0.3.111 → 0.3.113

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (37) hide show
  1. package/README.md +17 -3
  2. package/THIRD_PARTY_NOTICES.md +56 -0
  3. package/dist/cli.js +102938 -97144
  4. package/dist/core.js +6072 -4676
  5. package/package.json +3 -1
  6. package/src/gdgraph/affected-report.ts +14 -4
  7. package/src/gdgraph/build.ts +12 -9
  8. package/src/gdgraph/core-sources.ts +1 -0
  9. package/src/gdgraph/data-dir.ts +14 -0
  10. package/src/gdgraph/enrich.ts +5 -3
  11. package/src/gdgraph/query.ts +3 -2
  12. package/src/gdgraph/staleness.ts +8 -1
  13. package/src/gdgraph/wiki-layer.ts +9 -6
  14. package/src/gdskills/bundled/skills/orchestration/flow-orchestrator/SKILL.md +3 -3
  15. package/src/gdskills/bundled/skills/orchestration/job-orchestrator/SKILL.md +3 -3
  16. package/src/gdskills/bundled/skills/orchestration/job-orchestrator/orchestrator-prompt.md +2 -2
  17. package/src/gdskills/bundled/skills/orchestration/task-implementer/SKILL.md +4 -4
  18. package/src/gdskills/bundled/skills/planning/autodoc-orchestrator/SKILL.md +1 -1
  19. package/src/gdskills/bundled/skills/planning/interviewer/SKILL.md +3 -3
  20. package/src/gdskills/bundled/skills/quality/api-truth/SKILL.md +2 -2
  21. package/src/gdskills/bundled/skills/quality/deprecation-path/SKILL.md +3 -3
  22. package/src/gdskills/bundled/skills/quality/fresh-eyes/SKILL.md +2 -2
  23. package/src/gdskills/bundled/skills/quality/perf-check/SKILL.md +1 -1
  24. package/src/gdskills/bundled/skills/quality/root-cause/SKILL.md +2 -2
  25. package/src/gdskills/bundled/skills/review/review-architecture/SKILL.md +14 -15
  26. package/src/gdskills/bundled/skills/review/review-backend/SKILL.md +14 -14
  27. package/src/gdskills/bundled/skills/review/review-frontend/SKILL.md +13 -16
  28. package/src/gdskills/bundled/skills/review/review-logic/SKILL.md +14 -14
  29. package/src/gdskills/bundled/skills/review/review-orchestrator/SKILL.detail.md +42 -3
  30. package/src/gdskills/bundled/skills/review/review-orchestrator/SKILL.md +21 -19
  31. package/src/gdskills/bundled/skills/review/review-orchestrator/reviewer-finding.schema.json +16 -0
  32. package/src/gdskills/bundled/skills/review/review-orchestrator/reviewer-input.schema.json +47 -0
  33. package/src/gdskills/bundled/skills/review/review-orchestrator/templates/pr-comment-frontend.md +1 -1
  34. package/src/gdskills/bundled/skills/review/review-performance/SKILL.md +13 -13
  35. package/src/gdskills/bundled/skills/review/review-regression/SKILL.md +23 -25
  36. package/src/gdskills/bundled/skills/review/review-security-code/SKILL.md +13 -15
  37. package/src/gdskills/bundled/skills/review/review-testing-practices/SKILL.md +31 -57
@@ -192,20 +192,11 @@ pass, then work the checklist.
192
192
 
193
193
  ### Shared laws (every reviewer)
194
194
 
195
- 1. **A claim of runtime harm with no reproducible path is `info`.** If you cannot
196
- name the input, call, or condition that reaches the code, you have an
197
- observation, not a finding. Report it as `info` and say what would settle it.
198
- 2. **Never flag the theoretical.** The path you describe must exist in the code
199
- under review. Do not report a safe API because it could be misused, or a
200
- pattern because it is often wrong elsewhere.
201
- 3. **One finding per class, not one per occurrence.** When the same shape appears
202
- at several sites, report it once and list every site. Ten findings that are one
203
- finding hide the other nine problems.
204
-
205
- Severity levels are defined once, in `review-orchestrator/SKILL.md` →
206
- **Severity (canonical)**. This reviewer does not restate them: `blocker` is the
207
- four merge-blocking shapes named there and nothing else, and the `major`/`minor`
208
- boundary is the trigger-and-outcome test.
195
+ 1. **A claim of runtime harm with no reproducible path is `info`.** If you cannot name the input, call, or condition that reaches the code, you have an observation, not a finding. Report it as `info` and say what would settle it.
196
+ 2. **Never flag the theoretical.** The path you describe must exist in the code under review. Do not report a safe API because it could be misused, or a pattern because it is often wrong elsewhere.
197
+ 3. **One finding per class, not one per occurrence.** When the same shape appears at several sites, report it once and list every site. Ten findings that are one finding hide the other nine problems.
198
+
199
+ Severity levels are defined once, in `review-orchestrator/SKILL.md` → **Severity (canonical)**. This reviewer does not restate them: `blocker` is the four merge-blocking shapes named there and nothing else, and the `major`/`minor` boundary is the trigger-and-outcome test.
209
200
 
210
201
  ---
211
202
 
@@ -219,15 +210,9 @@ When dispatched by `review-orchestrator`, follow the provided `reviewer-input.sc
219
210
 
220
211
  ### Class scope — required for `blocker` and `major`
221
212
 
222
- Every `blocker` and `major` finding must carry `class_scope`: **every** site that
223
- holds the shape you found, and **how you enumerated them** — the grep or query
224
- you ran, or the guard that derives the set.
213
+ Every `blocker` and `major` finding must carry `class_scope`: **every** site that holds the shape you found, and **how you enumerated them** — the grep or query you ran, or the guard that derives the set.
225
214
 
226
- A finding anchored to one `file:line` is a claim about one site. The recorded
227
- history of this repository is that a fix then repairs that site and leaves its
228
- siblings: one writer of five, one operator instruction of four, six readers of
229
- eight. Each was found by the *next* review round, which is why reviews here have
230
- run to seven and four rounds instead of one.
215
+ A finding anchored to one `file:line` is a claim about one site. The recorded history of this repository is that a fix then repairs that site and leaves its siblings: one writer of five, one operator instruction of four, six readers of eight. Each was found by the *next* review round, which is why reviews here have run to seven and four rounds instead of one.
231
216
 
232
217
  ```yaml
233
218
  class_scope:
@@ -235,12 +220,9 @@ class_scope:
235
220
  enumeration_method: "grep for the config-path resolvers; 7 writers, 2 unguarded"
236
221
  ```
237
222
 
238
- "I checked the others" is not an enumeration method. A single-entry `sites` list
239
- is a claim that the class has exactly one member — make it deliberately, because
240
- `review-finding.schema.json` accepts it and the next round tests it.
223
+ "I checked the others" is not an enumeration method. A single-entry `sites` list is a claim that the class has exactly one member — make it deliberately, because `review-finding.schema.json` accepts it and the next round tests it.
241
224
 
242
- `minor` and `info` may omit it: enumerating the class for every low-severity
243
- observation is theatre, not rigour.
225
+ `minor` and `info` may omit it: enumerating the class for every low-severity observation is theatre, not rigour.
244
226
 
245
227
  ```markdown
246
228
  ### [F-NNN] Title
@@ -252,9 +234,7 @@ observation is theatre, not rigour.
252
234
  - **Fix**: concrete test rewrite or fixture/handler change
253
235
  ```
254
236
 
255
- Severity comes from **Severity (canonical)** in `review-orchestrator/SKILL.md`.
256
- This reviewer keeps no rubric of its own; what follows is where its recurring
257
- conditions land under that rubric.
237
+ Severity comes from **Severity (canonical)** in `review-orchestrator/SKILL.md`. This reviewer keeps no rubric of its own; what follows is where its recurring conditions land under that rubric.
258
238
 
259
239
  | Condition | Severity | Why, under the canonical rubric |
260
240
  |---|---|---|
@@ -266,22 +246,11 @@ conditions land under that rubric.
266
246
  | Substrate choice, smoke tagging, locator priority, co-location | `minor` | The suite is correct; the cost is to whoever maintains it |
267
247
  | A convention preference with no effect on determinism or signal | `info` | Shared laws 1 and 2 |
268
248
 
269
- A flaky test is `major`, not `blocker`: it wastes time, but it does not ship a
270
- defect. A test that cannot fail does — which is why it is the one `blocker` here.
249
+ A flaky test is `major`, not `blocker`: it wastes time, but it does not ship a defect. A test that cannot fail does — which is why it is the one `blocker` here.
271
250
 
272
- The three mutation-pass rows sit at `minor` deliberately, and the reasoning is
273
- the canonical rubric rather than modesty: a coverage gap names no runtime trigger
274
- and no user-visible outcome, so it cannot be `major` under the boundary test. What
275
- makes them worth reporting is not severity but **evidence class** — each one is a
276
- command that ran, which is the rarest thing in a review and the only kind of
277
- finding a later round cannot argue away. Report them with the mutation and its
278
- result, and they survive adjudication intact. Report them as "coverage looks
279
- thin" and they are correctly discarded.
251
+ The three mutation-pass rows sit at `minor` deliberately, and the reasoning is the canonical rubric rather than modesty: a coverage gap names no runtime trigger and no user-visible outcome, so it cannot be `major` under the boundary test. What makes them worth reporting is not severity but **evidence class** — each one is a command that ran, which is the rarest thing in a review and the only kind of finding a later round cannot argue away. Report them with the mutation and its result, and they survive adjudication intact. Report them as "coverage looks thin" and they are correctly discarded.
280
252
 
281
- The moment a surviving mutation is accompanied by a **reachable input that makes
282
- the unpinned code do the wrong thing**, that is a separate finding at the severity
283
- its own outcome earns — usually `major`. The coverage gap and the defect are two
284
- findings, not one, and conflating them loses whichever the adjudicator disbelieves.
253
+ The moment a surviving mutation is accompanied by a **reachable input that makes the unpinned code do the wrong thing**, that is a separate finding at the severity its own outcome earns — usually `major`. The coverage gap and the defect are two findings, not one, and conflating them loses whichever the adjudicator disbelieves.
285
254
 
286
255
  ---
287
256
 
@@ -303,17 +272,22 @@ findings, not one, and conflating them loses whichever the adjudicator disbeliev
303
272
 
304
273
  Report done only once all of these hold:
305
274
 
306
- - The mutation table is published in full, survivors and casualties both, or the
307
- report says which command failed and that the pass was skipped.
308
- - The report states the cap: how many added or previously-requested gates were
309
- mutated and how many were not reached.
310
- - Every finding names `file:line` and the evidence that settles it — the mutation
311
- and its result, the producer line, or the selector that names the branch.
312
- - Every `blocker` and `major` carries `class_scope` with `sites` and an
313
- `enumeration_method` naming the search that produced them.
314
- - No finding invents a severity: each lands under **Severity (canonical)** in
315
- `review-orchestrator/SKILL.md`, and a coverage gap is filed separately from any
316
- defect it exposes.
317
- - The reply is the `REVIEW_RESULT` the Orchestrated Review Contract asks for, or
318
- `NEEDS_CONTEXT` naming the context that was missing — never a guess in its place.
275
+ - The mutation table is published in full, survivors and casualties both, or the report says which command failed and that the pass was skipped.
276
+ - The report states the cap: how many added or previously-requested gates were mutated and how many were not reached.
277
+ - Every finding names `file:line` and the evidence that settles it — the mutation and its result, the producer line, or the selector that names the branch.
278
+ - Every `blocker` and `major` carries `class_scope` with `sites` and an `enumeration_method` naming the search that produced them.
279
+ - No finding invents a severity: each lands under **Severity (canonical)** in `review-orchestrator/SKILL.md`, and a coverage gap is filed separately from any defect it exposes.
280
+ - The reply is the `REVIEW_RESULT` the Orchestrated Review Contract asks for, or `NEEDS_CONTEXT` naming the context that was missing — never a guess in its place.
281
+
282
+ <!-- keryx:layers-block:start -->
283
+ ## Project layers: graph, tests, wiki, memory
284
+
285
+ Your payload may carry a `layers` block for your files: the files the graph says are affected, symbol neighbours, related tests, the wiki pages that describe the files and the memory entries for their module. It is bounded, and `truncated` names what was cut and the command that fetches the rest. When the diff alone does not settle a question, ask the project. Each command below is read-only and calls no model.
286
+
287
+ - `keryx gdgraph affected <file>`: who depends on the file. Use it before you call a change contained, and whenever a changed export, signature or behaviour may have callers outside your files.
288
+ - `keryx test related <file>`: the tests that cover the file. Use it before you say a behaviour is untested, and to judge whether a test would fail if the code broke.
289
+ - `keryx wiki ask "<q>"`: what the project wiki says a module is for and which rules bind it. Use it when the intent of the code is unclear and the diff does not state it.
290
+ - `keryx memory search "<q>"`: recorded lessons, decisions and known mistakes. Use it before you report a pattern the project may already have decided on, and when a failure looks like one it has seen.
319
291
 
292
+ In a review package, `keryx gdgraph affected <file> --data-dir <package>/layers/graph` reads the graph built at the PR head; the tracked graph may be from another commit. A finding still rests on the code you read: what a layer says is a lead, not evidence. If a layer is empty or a command fails, say so in the report instead of guessing.
293
+ <!-- keryx:layers-block:end -->