@olegkoval/agent-skills 1.40.0 → 1.41.0

package/.github/prompts/open-source-publisher.prompt.md

@@ -31,12 +31,11 @@ Use this skill to audit whether an OSS repository is ready to publish, then help
 5. For existing usable pieces, do not propose replacement by default. Ask a change-oriented question only when useful, for example:
    - "You already have a terminal-style GitHub Pages site. Do you want to keep it or restyle it?"
    - "You already have an icon and social card. Do you want a refresh, or should I leave them as-is?"
-   - "You already have a static social card. Do you want me to animate it with pixel2motion, or leave it static?"
    - "You already have release automation. Do you want me to audit only, or also tighten it?"
 6. Ask only for choices needed to fix missing or weak pieces:
    - If GitHub Pages is missing or weak, ask for style: `oldschool linux`, `terminal`, `modern`, `brutalist`, `glassmorphism`, `y2k`, `hacker`, or custom.
    - If donation wiring is missing, ask whether to enable it: `none`, `GitHub Sponsors`, `Ko-fi`, `Buy Me a Coffee`, `Open Collective`, `Thanks.dev`, or custom URL.
-   - If the repo has a generated static social image or hero card, ask whether to animate it using `nolangz/pixel2motion`.
+   - If the repo has a generated logo or simple hero artwork supported by `nolangz/pixel2motion`, ask whether to animate it or leave it static.
    - If the repo has no clear product essence, ask for a one-sentence positioning statement.
 7. Implement only approved, missing, or weak work in this order:
    - OSS governance and support files
@@ -200,8 +199,8 @@ Use `magick` or another renderer when `rsvg-convert` is unavailable.
 
 Some repos benefit from a short animated preview. Keep this opt-in.
 
-- If you already generated a static image, ask: `Do you want me to animate the static image using pixel2motion?`
-- If the user says yes, use `nolangz/pixel2motion` as the optional dependency for logo animation, animated HTML demos, and GIF/video previews.
+- After the user opts in during workflow step 6, animate only the approved generated logo or simple artwork.
+- Use `nolangz/pixel2motion` as the optional dependency for that animation, animated HTML demos, and GIF/video previews.
 - Do not auto-animate by default.
 
 ## README Standard

package/.kiro/steering/open-source-publisher.md

@@ -30,12 +30,11 @@ Use this skill to audit whether an OSS repository is ready to publish, then help
 5. For existing usable pieces, do not propose replacement by default. Ask a change-oriented question only when useful, for example:
    - "You already have a terminal-style GitHub Pages site. Do you want to keep it or restyle it?"
    - "You already have an icon and social card. Do you want a refresh, or should I leave them as-is?"
-   - "You already have a static social card. Do you want me to animate it with pixel2motion, or leave it static?"
    - "You already have release automation. Do you want me to audit only, or also tighten it?"
 6. Ask only for choices needed to fix missing or weak pieces:
    - If GitHub Pages is missing or weak, ask for style: `oldschool linux`, `terminal`, `modern`, `brutalist`, `glassmorphism`, `y2k`, `hacker`, or custom.
    - If donation wiring is missing, ask whether to enable it: `none`, `GitHub Sponsors`, `Ko-fi`, `Buy Me a Coffee`, `Open Collective`, `Thanks.dev`, or custom URL.
-   - If the repo has a generated static social image or hero card, ask whether to animate it using `nolangz/pixel2motion`.
+   - If the repo has a generated logo or simple hero artwork supported by `nolangz/pixel2motion`, ask whether to animate it or leave it static.
    - If the repo has no clear product essence, ask for a one-sentence positioning statement.
 7. Implement only approved, missing, or weak work in this order:
    - OSS governance and support files
@@ -199,8 +198,8 @@ Use `magick` or another renderer when `rsvg-convert` is unavailable.
 
 Some repos benefit from a short animated preview. Keep this opt-in.
 
-- If you already generated a static image, ask: `Do you want me to animate the static image using pixel2motion?`
-- If the user says yes, use `nolangz/pixel2motion` as the optional dependency for logo animation, animated HTML demos, and GIF/video previews.
+- After the user opts in during workflow step 6, animate only the approved generated logo or simple artwork.
+- Use `nolangz/pixel2motion` as the optional dependency for that animation, animated HTML demos, and GIF/video previews.
 - Do not auto-animate by default.
 
 ## README Standard

package/.windsurf/rules/open-source-publisher.md

@@ -29,12 +29,11 @@ Use this skill to audit whether an OSS repository is ready to publish, then help
 5. For existing usable pieces, do not propose replacement by default. Ask a change-oriented question only when useful, for example:
    - "You already have a terminal-style GitHub Pages site. Do you want to keep it or restyle it?"
    - "You already have an icon and social card. Do you want a refresh, or should I leave them as-is?"
-   - "You already have a static social card. Do you want me to animate it with pixel2motion, or leave it static?"
    - "You already have release automation. Do you want me to audit only, or also tighten it?"
 6. Ask only for choices needed to fix missing or weak pieces:
    - If GitHub Pages is missing or weak, ask for style: `oldschool linux`, `terminal`, `modern`, `brutalist`, `glassmorphism`, `y2k`, `hacker`, or custom.
    - If donation wiring is missing, ask whether to enable it: `none`, `GitHub Sponsors`, `Ko-fi`, `Buy Me a Coffee`, `Open Collective`, `Thanks.dev`, or custom URL.
-   - If the repo has a generated static social image or hero card, ask whether to animate it using `nolangz/pixel2motion`.
+   - If the repo has a generated logo or simple hero artwork supported by `nolangz/pixel2motion`, ask whether to animate it or leave it static.
    - If the repo has no clear product essence, ask for a one-sentence positioning statement.
 7. Implement only approved, missing, or weak work in this order:
    - OSS governance and support files
@@ -198,8 +197,8 @@ Use `magick` or another renderer when `rsvg-convert` is unavailable.
 
 Some repos benefit from a short animated preview. Keep this opt-in.
 
-- If you already generated a static image, ask: `Do you want me to animate the static image using pixel2motion?`
-- If the user says yes, use `nolangz/pixel2motion` as the optional dependency for logo animation, animated HTML demos, and GIF/video previews.
+- After the user opts in during workflow step 6, animate only the approved generated logo or simple artwork.
+- Use `nolangz/pixel2motion` as the optional dependency for that animation, animated HTML demos, and GIF/video previews.
 - Do not auto-animate by default.
 
 ## README Standard

package/adapters/claude/olko-github-pr/skills/lekker-review/SKILL.md

@@ -5,7 +5,7 @@ description: >
   isolated worktree, gathers context from your issue tracker, chat, docs, CI
   checks, and (optionally) production monitoring, runs 5 parallel specialized
   review agents (quality/implementation/simplification/conventions/test-quality),
-  verifies every finding against the diff, then outputs a single unified markdown
+  verifies every verdict-affecting finding against the diff, then outputs a single unified markdown
   review: file + risk + bad code + why it's wrong + fix, ready to paste directly
   into GitHub. Saves every review to ~/code-reviews/*.md. Covers business logic,
   scalability, complexity, data integrity, security, integration contracts, error
@@ -79,14 +79,11 @@ the 5 specialist agents still run and still find real bugs. They just don't
 have a codified "always Critical" rule list to check against.
 
 If any hard rule you define carries a `rule` tag (e.g. `"TS-1"`), reviewer
-agents attach that tag to matching findings and the workflow **skips
-adversarial verification** for them. This is deliberate: the verifier's five
-challenges ask runtime-failure questions ("does this fail on a normal
-execution?", "can you write the failing test?") that a standards violation
-can never answer, so verifying them systematically drops the very findings
-your policy declares non-negotiable. A tagged finding keeps its Critical
-severity; the workflow returns how many were exempted as `hardRuleCount`, and
-each carries a `verifierReasoning` saying so.
+agents attach that tag to matching findings. The verifier checks the diff
+anchor and rule applicability, but skips its five runtime-failure challenges.
+Those challenges cannot evaluate a standards violation. A tagged finding keeps
+Critical severity only when both rule-specific checks pass. The workflow
+returns the number checked as `hardRuleCount`.
 
 `${CLAUDE_PLUGIN_ROOT}` below refers to this skill's own installed directory:
 resolve every `references/...` and script path relative to it.
@@ -150,7 +147,7 @@ treat as a full review and leave PREV_SHA unset. Also grep the same file for
 | Context: chat/docs/framework-docs/monitoring/prior-review-memory (optional, MCP-dependent) | skip | included | included + broader recall |
 | Worktree + static checks    | skip (WORKTREE_PATH=null) unless `--fix` | included | included          |
 | Review agents               | 2 triage (haiku)      | 5 specialists (sonnet) | 5 specialists (sonnet)  |
-| Per-finding verification    | none                  | Criticals only (hard rules exempt) | Criticals + Importants (hard rules exempt) |
+| Per-finding verification    | Criticals + Importants | Criticals + Importants | Criticals + Importants |
 | Completeness critic         | skip                  | skip                | included                   |
 | Proof-of-bug (failing test per Critical) | skip     | included (max 5)    | included (max 5)           |
 | Living review artifact      | included              | included            | included                   |
@@ -298,8 +295,9 @@ The workflow runs three phases:
   description/badCode/fix of the set - a Critical is never demoted by an
   Observation someone else filed at the same line - and records every
   contributing dimension in `agreedBy`.
-- **Verify:** scan verifies nothing; medium verifies Criticals; deep verifies
-  Criticals + Importants. Hard-rule findings (`rule` set) are always exempt.
+- **Verify:** every Critical and Important is checked at every depth because it
+  can affect the verdict. Hard-rule findings (`rule` set) use the verifier's
+  diff-anchor and rule-applicability checks instead of runtime challenges.
   Each verifier runs the five-challenge adversarial refutation from
   `references/agents/verifier.md` against one finding, returns
   `{verdict, newSeverity?, reasoning}`. Verifiers run `maxConcurrent` at a time
@@ -311,13 +309,13 @@ The workflow runs three phases:
   one prover agent (`references/agents/prover.md`, sonnet, max 5, run
   `maxConcurrent` at a time) that writes a test asserting the CORRECT behaviour,
   runs it in the worktree, and captures it failing because of the bug. The proof rides on the finding as
-  `proof: {attempted, proven, reason, testCode?, testCommand?, redOutput?}`.
+  `proof: {attempted, proven, outcome, reason, testCode?, testCommand?, redOutput?}`.
   A proof that comes back GREEN (code behaved correctly) is counter-evidence -
-  Step 3 must downgrade or explicitly justify the finding, never ignore it.
+  the workflow automatically downgrades the finding from Critical to Important.
   Hard-rule findings are never proved (policy violations have no failing test).
 
 Findings have schema:
-`{file, line, severity, title, description, badCode, fix, rule?, precedent?, agreedBy?, verifierReasoning?, proof?}`
+`{file, line, severity, title, description, badCode, fix, rule?, precedent?, agreedBy?, verificationStatus?, verifierReasoning?, proof?}`
 `badCode` and `fix` are schema-required: an empty string is allowed only on
 `observation` / `idiomatic` findings.
 
@@ -326,7 +324,7 @@ provers on `sonnet`, housekeeping on `haiku`. Only the synthesis in Step 3 runs
 on the session model.
 
 Return value from the workflow:
-`{findings, droppedCount, downgradedCount, hardRuleCount, proveAttemptCount, provenCount, agentCount, outputTokens, turnTokensTotal}`
+`{findings, droppedCount, downgradedCount, hardRuleCount, proveAttemptCount, provenCount, acCoverage, coverageVerdict, mutationSlip, mockSmells, agentCount, outputTokens, turnTokensTotal}`
 `outputTokens` is this workflow's own output spend; `turnTokensTotal` is the
 whole turn's shared pool (main loop included).
 
@@ -411,7 +409,7 @@ requirements:
 - When `PREV_SHA` is set: include `## 🔁 Since last review` comparing
   `PREV_REVIEW_FILE` findings against the new head - list each as fixed or
   still open, before any new findings.
-- Test Quality section: populate from the test-quality agent's fields
+- Test Quality section: populate from the workflow return fields
   (`coverageVerdict`, `mutationSlip`, `mockSmells`).
 - Idiomatic section: populated from severity=idiomatic findings only.
 - **💰 Review Cost block:** `outputTokens` from the workflow return is the

package/adapters/claude/olko-github-pr/skills/lekker-review/references/agents/implementation.md

@@ -8,6 +8,7 @@ Axes to cover:
 - Business Logic / AC coverage: for each AC in the list below, mark
   ✅ met / ⚠️ partial / ❌ missing. Scope creep is also worth flagging.
   AC_LIST: read key "acList" from CONTEXT_FILE.
+  Return the complete status summary in the structured `acCoverage` field.
 - Scalability: N+1 queries, missing pagination, unbounded in-memory
   collections, missing rate-limit handling, cron jobs without overlap guard,
   missing DB indexes for new query patterns.
@@ -23,7 +24,7 @@ Axes to cover:
   Set `rule: "GQL-1"` on any Critical finding raised under this axis.
 
 Setting rule tags the finding as a house hard rule: it keeps its Critical
-severity and skips adversarial verification. Only set it for a genuine GQL-1
+severity only after rule-specific validation and skips runtime challenges. Only set it for a genuine GQL-1
 violation: never to shield an ordinary finding from verification.
 
 CI_STATUS: read key "ciStatus" from the JSON file CONTEXT_FILE.

package/adapters/claude/olko-github-pr/skills/lekker-review/references/agents/prover.md

@@ -1,6 +1,6 @@
 # prover -- lekker-review agent prompt
 # Receives: one FINDING as JSON, WORKTREE_PATH path, DIFF_FILE path, CONTEXT_FILE path
-# Returns: PROOF_SCHEMA { attempted: boolean, proven: boolean, reason: string, testCode?: string, testCommand?: string, redOutput?: string }
+# Returns: PROOF_SCHEMA { attempted: boolean, proven: boolean, outcome: 'proven'|'passed'|'inconclusive'|'not_attempted', reason: string, testCode?: string, testCommand?: string, redOutput?: string }
 
 ## Mission
 
@@ -29,8 +29,9 @@ explicitly.
 ## Step 1 -- Testability gate
 
 Read the FINDING, the real code at `file:line` in `WORKTREE_PATH`, and the diff
-context in `DIFF_FILE`. Return `attempted: false` with an honest one-sentence
-`reason` when any of these hold:
+context in `DIFF_FILE`. Return `attempted: false, proven: false,
+outcome: "not_attempted"` with an honest one-sentence `reason` when any of these
+hold:
 
 - The failure path requires live IO (Shopify/BC/Salesforce API, a real DB, the
   network) and the repo has no test infra to fake it cheaply.
@@ -77,25 +78,26 @@ Exactly one run command, scoped to your file only:
 Set the Bash tool's `timeout` parameter to 120000 for this call.
 
 If the runner hangs or the environment fails (missing config, transform
-errors), that is `attempted: true, proven: false` with the reason. Report
-honestly -- never retry more than once for a pure environment issue (e.g. a
-wrong config flag), and never loop.
+errors), that is `attempted: true, proven: false, outcome: "inconclusive"`
+with the reason. Report honestly -- never retry more than once for a pure
+environment issue (e.g. a wrong config flag), and never loop.
 
 ---
 
 ## Step 4 -- Judge the outcome
 
 - **Test FAILS, and the mismatch matches what the finding predicts** ->
-  `proven: true`. `redOutput` = the failure excerpt, trimmed to the
+  `proven: true, outcome: "proven"`. `redOutput` = the failure excerpt, trimmed to the
   informative ~15 lines (expected vs received + the failing assertion line).
   `testCode` = the full test file content. `testCommand` = the exact command
   you ran.
-- **Test PASSES** -> the finding did not reproduce. `proven: false`, and
+- **Test PASSES** -> the finding did not reproduce. `proven: false,
+  outcome: "passed"`, and
   `reason` states plainly that the code behaved correctly for the tested
   input. This is important review signal, not a failure of yours. Do NOT alter
   the test to force a failure.
 - **Test fails for an unrelated reason** (import error, env issue) ->
-  `proven: false`, honest `reason`.
+  `proven: false, outcome: "inconclusive"`, honest `reason`.
 
 ---
 
@@ -124,6 +126,7 @@ Return EXACTLY one JSON object matching PROOF_SCHEMA:
 {
   "attempted": true | false,
   "proven": true | false,
+  "outcome": "proven" | "passed" | "inconclusive" | "not_attempted",
   "reason": "<one or two sentences: why not attempted, why it proved, or why it didn't reproduce>",
   "testCode": "<full test file content -- only when attempted>",
   "testCommand": "<exact command run -- only when attempted>",
@@ -131,5 +134,5 @@ Return EXACTLY one JSON object matching PROOF_SCHEMA:
 }
 ```
 
-`attempted: false` implies `proven: false` and omits `testCode`/`testCommand`/
+`attempted: false` implies `proven: false, outcome: "not_attempted"` and omits `testCode`/`testCommand`/
 `redOutput`. Do not narrate outside the object.

package/adapters/claude/olko-github-pr/skills/lekker-review/references/agents/quality.md

@@ -56,7 +56,7 @@ Axes to cover:
   or a `node_modules` path.
 
 Setting rule tags the finding as a house hard rule: it keeps its Critical
-severity and skips adversarial verification. Only set it for a genuine
+severity only after rule-specific validation and skips runtime challenges. Only set it for a genuine
 TS-1/TS-2 violation: never to shield an ordinary finding from verification.
 
 CI_STATUS: read key "ciStatus" from the JSON file CONTEXT_FILE.

package/adapters/claude/olko-github-pr/skills/lekker-review/references/agents/test-quality.md

@@ -141,6 +141,13 @@ criticism without a fix is incomplete.
 Report the mutation-slip analysis as a single paragraph under a
 "**Mutation-slip risk:**" heading, not as line items.
 
+Return the review summary through these structured fields in addition to
+`findings`:
+- `coverageVerdict`: one concise overall coverage verdict.
+- `mutationSlip`: the mutation-slip risk paragraph.
+- `mockSmells`: every mock-smell issue as `{file, line, description, fix}`.
+  Return an empty array when there are no mock smells.
+
 EXISTING_REVIEWS: read key "existingReviews" from CONTEXT_FILE (awareness only, skip findings already raised)
 
 PROJECT_RULES to verify: read key "projectRules" from CONTEXT_FILE.

package/adapters/claude/olko-github-pr/skills/lekker-review/references/agents/triage-quality.md

@@ -20,7 +20,7 @@ Axes to cover (Critical/Important only):
   set `rule: "GQL-1"` when Critical
 
 Setting rule tags the finding as a house hard rule: it keeps its Critical
-severity and skips adversarial verification. Only set it for a genuine
+severity only after rule-specific validation and skips runtime challenges. Only set it for a genuine
 TS-1/TS-2/GQL-1 violation: never to shield an ordinary finding from
 verification.
 

package/adapters/claude/olko-github-pr/skills/lekker-review/references/agents/verifier.md

@@ -1,5 +1,5 @@
 # verifier -- lekker-review agent prompt
-# Receives: one FINDING as JSON, DIFF_FILE path, CONTEXT_FILE path, WORKTREE_PATH path
+# Receives: one FINDING as JSON, DIFF_FILE path, CONTEXT_FILE path, WORKTREE_PATH path, HOUSE_RULES_FILE path
 # Returns: VERDICT_SCHEMA { verdict: 'confirmed'|'downgraded'|'dropped', newSeverity?, reasoning }
 
 ## Mindset
@@ -18,17 +18,19 @@ verified yourself are not confirmed findings.
 
 You have received one candidate finding as JSON (field `FINDING` in your task
 message). Run all applicable verification checks below against the finding using
-`DIFF_FILE`, `CONTEXT_FILE`, and `WORKTREE_PATH` (read from the task message).
+`DIFF_FILE`, `CONTEXT_FILE`, `WORKTREE_PATH`, and `HOUSE_RULES_FILE` (read from
+the task message).
 
 When in doubt, drop. A Critical must pass ALL FIVE challenges to remain Critical
--- unless Step 0 exempts it as a house hard rule, which is the one exception.
+unless Step 0 validates it through the house hard-rule path.
 
 ---
 
-## Step 0 -- Hard-rule exemption (check this FIRST)
+## Step 0 -- Hard-rule validation (check this FIRST)
 
-If the FINDING JSON has a `rule` field set to `TS-1`, `TS-2`, `GQL-1`, or
-`PR-1`, do NOT run the five adversarial challenges below. They ask
+If the FINDING JSON has any non-empty `rule` field, including built-in tags
+such as `TS-1`, `TS-2`, `GQL-1`, or `PR-1`, do NOT run the five adversarial
+challenges below. They ask
 runtime-failure questions that a standards violation can never answer, and
 answering them honestly would drop a finding that house-rules policy declares
 Critical on standards grounds rather than on runtime behaviour.
@@ -41,8 +43,9 @@ Instead run exactly two checks:
    ```bash
    grep "^+" "$DIFF_FILE" | grep "<snippet>"
    ```
-2. **Rule applicability**: the code really does violate the rule as written
-   in `references/house-rules.md` -- e.g. an `as const` is not a type cast in
+2. **Rule applicability**: read the exact `HOUSE_RULES_FILE` path from the task
+   message, then confirm the code really violates the rule as written there --
+   e.g. an `as const` is not a type cast in
    the TS-1 sense; a `nodes` query that legitimately fetches a single known
    node with a documented comment may satisfy GQL-1; a `.js` file inside a
    Liquid theme repo is exempt from TS-2.
@@ -253,7 +256,7 @@ the inference is the crux of the claim
 ## Outcome rules
 
 The one exception to "a Critical must pass ALL FIVE challenges" is the
-hard-rule path in Step 0: a `rule`-tagged finding is judged solely on the
+hard-rule path in Step 0: a `rule`-tagged finding is validated solely on the
 anchor + rule-applicability checks and never runs the five challenges.
 
 A Critical finding must pass ALL FIVE challenges. Any failure downgrades:

package/adapters/claude/olko-github-pr/skills/lekker-review/references/artifact-page.md

@@ -18,7 +18,7 @@ All of the following are already in hand after Step 3 of SKILL.md:
 - `findings.json` path (scratchpad) -- each finding carries: `file`, `line`,
   `severity`, `title`, `description`, `badCode`, `fix`, `rule?`, `precedent?`,
   `agreedBy?`, `verifierReasoning?`, `proof?` (proof = `{attempted, proven,
-  reason, testCode?, testCommand?, redOutput?}`).
+  outcome, reason, testCode?, testCommand?, redOutput?}`).
 - The saved review file path: `~/code-reviews/YYYY-MM-DD-pr-N-repo.md`.
 - PR metadata: `REPO_SLUG`, `PR_NUMBER`, `PR_URL`, title, author, `headRefName`
   → `baseRefName`, head sha, depth, verdict, `isDraft`, `mergeStateStatus`, CI
@@ -96,6 +96,11 @@ Hard requirements for the HTML page:
   `<pre>`, a one-line explanation that the test asserts correct behavior, and
   `testCode` collapsed behind its own `<details>`. This is the page's
   centerpiece -- make it prominent (e.g. a red left border) but not garish.
+  When `proof.outcome === 'passed'`, render a distinct
+  "COUNTER-EVIDENCE -- focused proof test passed" panel with `reason`,
+  `testCommand`, and `testCode` collapsed behind its own `<details>`. Explain
+  that the workflow downgraded the finding to Important; do not present the
+  passing input as proof that every related input is safe.
 - **Test Quality + Review Cost sections**, mirrored from the review file,
   kept concise (verdict + gaps + cost table; no need to reproduce every
   sentence).

package/adapters/claude/olko-github-pr/skills/lekker-review/references/output-format.md

@@ -217,7 +217,7 @@ if empty.)*
 Depth:            <⚡ scan | 🔍 medium | 🔬 deep>
 Diff size:        ~<N> lines (~<N> tokens)
 Agents run:       <N total>: <breakdown, e.g. "5 reviewers (sonnet) + 6 verifiers (sonnet) + 2 provers (sonnet) + 1 critic (sonnet)">
-Verify skipped:   <N> hard-rule finding(s) exempt from adversarial verification (omit the line when 0)
+Rule checks:      <N> hard-rule finding(s) validated with rule-specific checks (omit the line when 0)
 Context sources:  <the subset of issue-tracker / chat / docs / framework-docs / monitoring / CI / prior-review-memory actually used>
 
 Output tokens:    <N>   ← ACTUAL workflow spend, from the workflow's outputTokens return value
@@ -253,10 +253,7 @@ Reviewer agents, verifiers, provers, and the critic all run on sonnet; triage an
   self-contained but silently breaks callers.
 - Blank line between findings. No double blank lines.
 - No trailing whitespace, no HTML tags, no ANSI escapes.
-- **Proof counter-evidence rule**: when `proof.attempted` is true but `proven`
-  is false because the code behaved correctly for the tested input, the
-  synthesis MUST treat that as counter-evidence: either downgrade the finding
-  or state in the finding body why the proof attempt doesn't exonerate it
-  (e.g. the tested input wasn't the one that actually breaks). A finding whose
-  proof came back green cannot silently stay Critical. When `attempted` is
-  false, say nothing: untestable is not evidence either way.
+- **Proof counter-evidence rule**: when `proof.outcome` is `passed`, the
+  workflow has already downgraded the finding from Critical to Important.
+  Explain the passing proof in the finding body. When `attempted` is false,
+  say nothing: untestable is not evidence either way.

package/adapters/claude/olko-github-pr/skills/lekker-review/scripts/selftest.mjs

@@ -0,0 +1,174 @@
+#!/usr/bin/env node
+// Zero-agent regression test for lekker-review's PURE logic.
+//
+// Why this exists: every defect found in the 2026-08-31 hardening pass was in
+// pure, synchronous code - the dedup bucket key, the hard-rule exemption gate,
+// the model/effort routing - yet the only way to exercise any of it was a live
+// workflow run costing ~7 agents and 70+ seconds. This runs the same logic in
+// milliseconds with no agents at all. Run it after ANY edit to workflow.js:
+//
+//   node ~/.claude/skills/lekker-review/scripts/selftest.mjs
+//
+// It lifts the real functions out of workflow.js by source extraction rather
+// than importing, because workflow.js is written for the Workflow harness (top
+// level `return`, an injected `args` global) and is not importable as a module.
+import { readFileSync } from 'node:fs'
+import { fileURLToPath } from 'node:url'
+import { dirname, join } from 'node:path'
+
+const SKILL = dirname(dirname(fileURLToPath(import.meta.url)))
+// Optional arg: a different workflow.js to test. Used to prove this suite
+// actually discriminates - point it at a pre-fix backup and it must FAIL.
+const target = process.argv[2] || join(SKILL, 'workflow.js')
+const src = readFileSync(target, 'utf8')
+console.log(`selftest target: ${target}`)
+
+function lift(name) {
+  const i = src.indexOf(`function ${name}`)
+  if (i === -1) throw new Error(`selftest: function ${name} not found in workflow.js - was it renamed?`)
+  let d = 0, j = i
+  for (;; j++) {
+    if (src[j] === '{') d++
+    else if (src[j] === '}') { d--; if (d === 0) break }
+  }
+  return src.slice(i, j + 1)
+}
+
+function liftConst(name) {
+  const m = new RegExp(`^const ${name} = .*$`, 'm').exec(src)
+  if (!m) throw new Error(`selftest: const ${name} not found in workflow.js`)
+  return m[0]
+}
+
+const preamble = [
+  liftConst('HARD_RULES'),
+  (() => { try { return liftConst('SAME_ISSUE_LINE_WINDOW') } catch { return 'const SAME_ISSUE_LINE_WINDOW = 30' } })(),
+  "const SEVERITY_RANK = { observation: 0, idiomatic: 1, important: 2, critical: 3 }",
+  ...['titleTokens', 'sameIssue', 'nearbyLines', 'spanWithinWindow', 'hardRuleCorroborated',
+      'isHardRule', 'longest', 'mergeFindings', 'dedup', 'shouldVerify'].map(n => {
+        try { return lift(n) } catch { return `function ${n}() { throw new Error('${n} absent from this workflow.js') }` }
+      }),
+].join('\n')
+
+const { dedup, isHardRule, shouldVerify, sameIssue } =
+  new Function(preamble + '\nreturn { dedup, isHardRule, shouldVerify, sameIssue }')()
+
+let failed = 0
+function check(name, actual, expected) {
+  const a = JSON.stringify(actual), e = JSON.stringify(expected)
+  if (a === e) { console.log(`  ok   ${name}`) }
+  else { console.log(`  FAIL ${name}\n         expected ${e}\n         actual   ${a}`); failed++ }
+}
+
+console.log('\ndedup: the same defect anchored at different lines must merge')
+// Regression: bucketing on `file:line` meant these two were never compared,
+// despite a title similarity of 0.64 against a 0.4 threshold. Observed live.
+const dupes = [
+  { file: 'src/total.ts', line: 14, severity: 'critical', title: 'Off-by-one loop skips the first cart line', badCode: 'for (let i = 1;', description: 'aaa' },
+  { file: 'src/total.ts', line: 9,  severity: 'critical', title: 'cartTotal skips the first line item (off-by-one loop start)', badCode: 'for (let i = 1;', description: 'bb' },
+]
+check('two anchors, one issue -> 1 finding', dedup(dupes).length, 1)
+check('merge keeps the highest severity', dedup([
+  { file: 'a.ts', line: 3, severity: 'observation', title: 'Off-by-one loop skips first line', badCode: '', description: '' },
+  { file: 'a.ts', line: 5, severity: 'critical',    title: 'Off-by-one loop skips the first line', badCode: '', description: '' },
+])[0].severity, 'critical')
+
+console.log('\ndedup: distinct issues must NOT be merged')
+check('similar titles 390 lines apart stay separate', dedup([
+  { file: 'big.ts', line: 10,  severity: 'important', title: 'Missing pagination on the products query', badCode: '', description: '' },
+  { file: 'big.ts', line: 400, severity: 'important', title: 'Missing pagination on the orders query',   badCode: '', description: '' },
+]).length, 2)
+check('same line, unrelated titles stay separate', dedup([
+  { file: 'a.ts', line: 7, severity: 'important', title: 'Unbounded retry loop hides throttling', badCode: '', description: '' },
+  { file: 'a.ts', line: 7, severity: 'important', title: 'Metafield namespace hardcoded in the query', badCode: '', description: '' },
+]).length, 2)
+// Grouping must not depend on arrival order. With only g[0] compared, findings
+// at 25, 50 and 1 all joined when 25 arrived first, spanning 49 lines.
+const spanCase = [
+  { file: 'a.ts', line: 25, severity: 'important', title: 'Missing pagination on the query', badCode: '', description: '' },
+  { file: 'a.ts', line: 50, severity: 'important', title: 'Missing pagination on the query', badCode: '', description: '' },
+  { file: 'a.ts', line: 1,  severity: 'important', title: 'Missing pagination on the query', badCode: '', description: '' },
+]
+check('a group never spans more than the window (25, 50, 1)', dedup(spanCase).length, 2)
+check('the same set in a different order gives the same answer',
+  dedup([spanCase[2], spanCase[0], spanCase[1]]).length, dedup(spanCase).length)
+
+check('different files never merge', dedup([
+  { file: 'a.ts', line: 7, severity: 'critical', title: 'Off-by-one loop skips the first line', badCode: '', description: '' },
+  { file: 'b.ts', line: 7, severity: 'critical', title: 'Off-by-one loop skips the first line', badCode: '', description: '' },
+]).length, 2)
+
+console.log('\nhard rules: a tag must be corroborated to skip verification')
+// Regression: any agent could bypass the verifier by writing rule: "TS-1".
+// Observed live - a test-coverage finding and a comment-policy finding both did.
+check('TS-1 on a comment-policy finding is NOT exempt',
+  isHardRule({ rule: 'TS-1', file: 'a.ts', line: 6, title: 'Comment restates the function', badCode: '/** Sum a cart. */', description: 'a comment earns its place' }), false)
+check('TS-1 on a test-coverage finding is NOT exempt',
+  isHardRule({ rule: 'TS-1', file: 'a.ts', line: 8, title: 'No test coverage', badCode: 'for (let i = 1;', description: 'zero test files added' }), false)
+check('an unknown rule string is NOT exempt',
+  isHardRule({ rule: 'MADE-UP', file: 'a.ts', line: 1, title: 't', badCode: 'x as Foo', description: '' }), false)
+// TS-1 is judged on quoted code only: prose is full of `as` and `any`.
+check('the word "any" in PROSE alone is NOT exempt',
+  isHardRule({ rule: 'TS-1', file: 'a.ts', line: 1, title: 'fails on any cart with items', badCode: 'total += lines[i].price', description: 'any agent could trip this' }), false)
+check('the phrase "such as" in prose alone is NOT exempt',
+  isHardRule({ rule: 'TS-1', file: 'a.ts', line: 1, title: 'issue', badCode: 'const n = 1', description: 'a primitive such as String is used' }), false)
+
+console.log('\nhard rules: genuine violations must STILL be exempt')
+check('TS-1 with a real cast',   isHardRule({ rule: 'TS-1', file: 'a.ts', line: 1, title: 'cast', badCode: 'const x = y as Foo;', description: '' }), true)
+check('TS-1 with a real any',    isHardRule({ rule: 'TS-1', file: 'a.ts', line: 1, title: 'any',  badCode: 'function f(x: any) {}', description: '' }), true)
+check('TS-2 with a .js path',    isHardRule({ rule: 'TS-2', file: 'web/thing.js', line: 1, title: 'js added', badCode: '', description: '' }), true)
+check('GQL-1 with a nodes query',isHardRule({ rule: 'GQL-1', file: 'q.graphql', line: 1, title: 'no pageInfo', badCode: 'products { nodes { id } }', description: '' }), true)
+check('PR-1 anchored on the PR title', isHardRule({ rule: 'PR-1', file: 'PR title', line: 1, title: 'missing prefix', badCode: '', description: '' }), true)
+// A cast to a lowercase built-in is as much a TS-1 violation as a cast to a
+// named type. Missing it sent a genuine hard rule to a verifier that cannot
+// answer a policy claim, where it could be dropped.
+for (const cast of ['x as string', 'x as number', 'x as unknown as Foo', 'x as const', 'x as boolean']) {
+  check(`TS-1 corroborated by \`${cast}\``,
+    isHardRule({ rule: 'TS-1', file: 'a.ts', line: 1, title: 'cast', badCode: cast, description: '' }), true)
+}
+check('TS-1 corroborated by an any annotation',
+  isHardRule({ rule: 'TS-1', file: 'a.ts', line: 1, title: 'any', badCode: 'function f(x: any) {}', description: '' }), true)
+check('TS-1 corroborated by an any[] ',
+  isHardRule({ rule: 'TS-1', file: 'a.ts', line: 1, title: 'any', badCode: 'const xs: any[] = []', description: '' }), true)
+
+console.log('\nverification scope by depth')
+const crit = { severity: 'critical' }, imp = { severity: 'important' }, obs = { severity: 'observation' }
+check('scan verifies nothing',            [crit, imp, obs].map(f => shouldVerify(f, 'scan')),   [false, false, false])
+check('medium verifies criticals only',   [crit, imp, obs].map(f => shouldVerify(f, 'medium')), [true, false, false])
+check('deep verifies crit + important',   [crit, imp, obs].map(f => shouldVerify(f, 'deep')),   [true, true, false])
+check('a corroborated hard rule is never verified',
+  shouldVerify({ severity: 'critical', rule: 'TS-2', file: 'x.js', badCode: '', description: '', title: '' }, 'deep'), false)
+
+// Per-host model routing is optional: a deployment may pin models per host via
+// a MODEL_TABLE, or leave every agent() call to name its own model. Test it
+// only when it is present, so this suite runs against either shape.
+const routingAssign = /const\s+MODEL\s*=\s*MODEL_TABLE\s*\[\s*HOST\s*\]/.exec(src)
+const hasRouting = Boolean(routingAssign)
+// A guard that can silently disable itself is worse than no guard. If the file
+// clearly HAS a MODEL_TABLE but the assignment did not parse, that is a failure,
+// not a reason to skip.
+if (!hasRouting && /MODEL_TABLE/.test(src)) {
+  check('MODEL_TABLE is present but its assignment was not recognised', false, true)
+}
+if (!hasRouting) {
+  console.log('\nmodel + effort routing: not configured in this workflow.js, skipped')
+} else {
+  console.log('\nmodel + effort routing is pinned per host, never inherited')
+  const routing = new Function('input', [
+    src.slice(src.indexOf('const HOST = '), routingAssign.index + routingAssign[0].length),
+    'return { HOST, MODEL }',
+  ].join('\n'))
+  check('an absent host arg falls back to the default table', routing({}).MODEL, routing({ host: 'claude' }).MODEL)
+  check('an unknown host falls back to the default, not an invalid model', routing({ host: 'nonsense' }).HOST, 'claude')
+  check('host matching is case-insensitive', routing({ host: 'CODEX' }).HOST, 'codex')
+  // Every role must resolve to a non-empty model, and effort must be set.
+  for (const host of ['claude', 'codex']) {
+    const m = routing({ host }).MODEL
+    const roles = Object.keys(m).filter(k => k !== 'effort')
+    check(`${host}: every role resolves to a model`, roles.every(r => typeof m[r] === 'string' && m[r].length > 0), true)
+    check(`${host}: effort is set`, typeof m.effort === 'string' && m.effort.length > 0, true)
+  }
+}
+
+console.log(failed === 0 ? '\nall checks passed\n' : `\n${failed} check(s) FAILED\n`)
+process.exit(failed === 0 ? 0 : 1)

package/adapters/claude/olko-reflection/skills/self-critique/scripts/critique-nudge.mjs

@@ -11,6 +11,9 @@ import { readFileSync } from 'node:fs';
 const THRESHOLD = 1500;
 const OFFER_MARKER = /critical-thinking review/i; // the offer line must contain this; doubles as a loop guard
 
+/**
+ * Exits the hook cleanly when conditions for offering a critique are not met.
+ */
 function bail() { process.exit(0); } // any uncertainty => do nothing, never block the user
 
 let raw = '';

package/adapters/claude/olko-release/skills/open-source-publisher/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: open-source-publisher
-description: Prepare an open-source repository for polished public publishing. Use when a user asks to publish, open-source, launch, polish, package, brand, or make a GitHub project presentable with a minimal project icon, social preview image, GitHub Pages landing page, standardized README, essential shields, CI/CD quality gates, release automation checks, and optional donation setup. Prefer the external `logo-generator` skill for icon generation when available, and `nolangz/pixel2motion` for optional motion previews of generated static images.
+description: Prepare an open-source repository for polished public publishing. Use when a user asks to publish, open-source, launch, polish, package, brand, or make a GitHub project presentable with a minimal project icon, social preview image, GitHub Pages landing page, standardized README, essential shields, CI/CD quality gates, release automation checks, and optional donation setup. Prefer the external `logo-generator` skill for icon generation when available, and `nolangz/pixel2motion` for optional motion previews of supported logos or simple artwork.
 license: MIT
 allowed-tools: Bash, Read, Write, Edit, WebSearch, WebFetch
 compatibility: Codex, Claude Code, Cursor, GitHub Copilot, Windsurf, Kiro, and other Agent Skills compatible tools. Requires a writable git repository; browser or image rendering tools are useful for visual validation.
@@ -44,12 +44,11 @@ Use this skill to audit whether an OSS repository is ready to publish, then help
 5. For existing usable pieces, do not propose replacement by default. Ask a change-oriented question only when useful, for example:
    - "You already have a terminal-style GitHub Pages site. Do you want to keep it or restyle it?"
    - "You already have an icon and social card. Do you want a refresh, or should I leave them as-is?"
-   - "You already have a static social card. Do you want me to animate it with pixel2motion, or leave it static?"
    - "You already have release automation. Do you want me to audit only, or also tighten it?"
 6. Ask only for choices needed to fix missing or weak pieces:
    - If GitHub Pages is missing or weak, ask for style: `oldschool linux`, `terminal`, `modern`, `brutalist`, `glassmorphism`, `y2k`, `hacker`, or custom.
    - If donation wiring is missing, ask whether to enable it: `none`, `GitHub Sponsors`, `Ko-fi`, `Buy Me a Coffee`, `Open Collective`, `Thanks.dev`, or custom URL.
-   - If the repo has a generated static social image or hero card, ask whether to animate it using `nolangz/pixel2motion`.
+   - If the repo has a generated logo or simple hero artwork supported by `nolangz/pixel2motion`, ask whether to animate it or leave it static.
    - If the repo has no clear product essence, ask for a one-sentence positioning statement.
 7. Implement only approved, missing, or weak work in this order:
    - OSS governance and support files
@@ -213,8 +212,8 @@ Use `magick` or another renderer when `rsvg-convert` is unavailable.
 
 Some repos benefit from a short animated preview. Keep this opt-in.
 
-- If you already generated a static image, ask: `Do you want me to animate the static image using pixel2motion?`
-- If the user says yes, use `nolangz/pixel2motion` as the optional dependency for logo animation, animated HTML demos, and GIF/video previews.
+- After the user opts in during workflow step 6, animate only the approved generated logo or simple artwork.
+- Use `nolangz/pixel2motion` as the optional dependency for that animation, animated HTML demos, and GIF/video previews.
 - Do not auto-animate by default.
 
 ## README Standard

package/adapters/cursor/olko-reflection/skills/self-critique/scripts/critique-nudge.mjs

@@ -11,6 +11,9 @@ import { readFileSync } from 'node:fs';
 const THRESHOLD = 1500;
 const OFFER_MARKER = /critical-thinking review/i; // the offer line must contain this; doubles as a loop guard
 
+/**
+ * Exits the hook cleanly when conditions for offering a critique are not met.
+ */
 function bail() { process.exit(0); } // any uncertainty => do nothing, never block the user
 
 let raw = '';