@olegkoval/agent-skills 1.40.0 → 1.41.0

package/plugins/olko-github-pr/skills/lekker-review/scripts/selftest.mjs

@@ -0,0 +1,174 @@
+#!/usr/bin/env node
+// Zero-agent regression test for lekker-review's PURE logic.
+//
+// Why this exists: every defect found in the 2026-08-31 hardening pass was in
+// pure, synchronous code - the dedup bucket key, the hard-rule exemption gate,
+// the model/effort routing - yet the only way to exercise any of it was a live
+// workflow run costing ~7 agents and 70+ seconds. This runs the same logic in
+// milliseconds with no agents at all. Run it after ANY edit to workflow.js:
+//
+//   node ~/.claude/skills/lekker-review/scripts/selftest.mjs
+//
+// It lifts the real functions out of workflow.js by source extraction rather
+// than importing, because workflow.js is written for the Workflow harness (top
+// level `return`, an injected `args` global) and is not importable as a module.
+import { readFileSync } from 'node:fs'
+import { fileURLToPath } from 'node:url'
+import { dirname, join } from 'node:path'
+
+const SKILL = dirname(dirname(fileURLToPath(import.meta.url)))
+// Optional arg: a different workflow.js to test. Used to prove this suite
+// actually discriminates - point it at a pre-fix backup and it must FAIL.
+const target = process.argv[2] || join(SKILL, 'workflow.js')
+const src = readFileSync(target, 'utf8')
+console.log(`selftest target: ${target}`)
+
+function lift(name) {
+  const i = src.indexOf(`function ${name}`)
+  if (i === -1) throw new Error(`selftest: function ${name} not found in workflow.js - was it renamed?`)
+  let d = 0, j = i
+  for (;; j++) {
+    if (src[j] === '{') d++
+    else if (src[j] === '}') { d--; if (d === 0) break }
+  }
+  return src.slice(i, j + 1)
+}
+
+function liftConst(name) {
+  const m = new RegExp(`^const ${name} = .*$`, 'm').exec(src)
+  if (!m) throw new Error(`selftest: const ${name} not found in workflow.js`)
+  return m[0]
+}
+
+const preamble = [
+  liftConst('HARD_RULES'),
+  (() => { try { return liftConst('SAME_ISSUE_LINE_WINDOW') } catch { return 'const SAME_ISSUE_LINE_WINDOW = 30' } })(),
+  "const SEVERITY_RANK = { observation: 0, idiomatic: 1, important: 2, critical: 3 }",
+  ...['titleTokens', 'sameIssue', 'nearbyLines', 'spanWithinWindow', 'hardRuleCorroborated',
+      'isHardRule', 'longest', 'mergeFindings', 'dedup', 'shouldVerify'].map(n => {
+        try { return lift(n) } catch { return `function ${n}() { throw new Error('${n} absent from this workflow.js') }` }
+      }),
+].join('\n')
+
+const { dedup, isHardRule, shouldVerify, sameIssue } =
+  new Function(preamble + '\nreturn { dedup, isHardRule, shouldVerify, sameIssue }')()
+
+let failed = 0
+function check(name, actual, expected) {
+  const a = JSON.stringify(actual), e = JSON.stringify(expected)
+  if (a === e) { console.log(`  ok   ${name}`) }
+  else { console.log(`  FAIL ${name}\n         expected ${e}\n         actual   ${a}`); failed++ }
+}
+
+console.log('\ndedup: the same defect anchored at different lines must merge')
+// Regression: bucketing on `file:line` meant these two were never compared,
+// despite a title similarity of 0.64 against a 0.4 threshold. Observed live.
+const dupes = [
+  { file: 'src/total.ts', line: 14, severity: 'critical', title: 'Off-by-one loop skips the first cart line', badCode: 'for (let i = 1;', description: 'aaa' },
+  { file: 'src/total.ts', line: 9,  severity: 'critical', title: 'cartTotal skips the first line item (off-by-one loop start)', badCode: 'for (let i = 1;', description: 'bb' },
+]
+check('two anchors, one issue -> 1 finding', dedup(dupes).length, 1)
+check('merge keeps the highest severity', dedup([
+  { file: 'a.ts', line: 3, severity: 'observation', title: 'Off-by-one loop skips first line', badCode: '', description: '' },
+  { file: 'a.ts', line: 5, severity: 'critical',    title: 'Off-by-one loop skips the first line', badCode: '', description: '' },
+])[0].severity, 'critical')
+
+console.log('\ndedup: distinct issues must NOT be merged')
+check('similar titles 390 lines apart stay separate', dedup([
+  { file: 'big.ts', line: 10,  severity: 'important', title: 'Missing pagination on the products query', badCode: '', description: '' },
+  { file: 'big.ts', line: 400, severity: 'important', title: 'Missing pagination on the orders query',   badCode: '', description: '' },
+]).length, 2)
+check('same line, unrelated titles stay separate', dedup([
+  { file: 'a.ts', line: 7, severity: 'important', title: 'Unbounded retry loop hides throttling', badCode: '', description: '' },
+  { file: 'a.ts', line: 7, severity: 'important', title: 'Metafield namespace hardcoded in the query', badCode: '', description: '' },
+]).length, 2)
+// Grouping must not depend on arrival order. With only g[0] compared, findings
+// at 25, 50 and 1 all joined when 25 arrived first, spanning 49 lines.
+const spanCase = [
+  { file: 'a.ts', line: 25, severity: 'important', title: 'Missing pagination on the query', badCode: '', description: '' },
+  { file: 'a.ts', line: 50, severity: 'important', title: 'Missing pagination on the query', badCode: '', description: '' },
+  { file: 'a.ts', line: 1,  severity: 'important', title: 'Missing pagination on the query', badCode: '', description: '' },
+]
+check('a group never spans more than the window (25, 50, 1)', dedup(spanCase).length, 2)
+check('the same set in a different order gives the same answer',
+  dedup([spanCase[2], spanCase[0], spanCase[1]]).length, dedup(spanCase).length)
+
+check('different files never merge', dedup([
+  { file: 'a.ts', line: 7, severity: 'critical', title: 'Off-by-one loop skips the first line', badCode: '', description: '' },
+  { file: 'b.ts', line: 7, severity: 'critical', title: 'Off-by-one loop skips the first line', badCode: '', description: '' },
+]).length, 2)
+
+console.log('\nhard rules: a tag must be corroborated to skip verification')
+// Regression: any agent could bypass the verifier by writing rule: "TS-1".
+// Observed live - a test-coverage finding and a comment-policy finding both did.
+check('TS-1 on a comment-policy finding is NOT exempt',
+  isHardRule({ rule: 'TS-1', file: 'a.ts', line: 6, title: 'Comment restates the function', badCode: '/** Sum a cart. */', description: 'a comment earns its place' }), false)
+check('TS-1 on a test-coverage finding is NOT exempt',
+  isHardRule({ rule: 'TS-1', file: 'a.ts', line: 8, title: 'No test coverage', badCode: 'for (let i = 1;', description: 'zero test files added' }), false)
+check('an unknown rule string is NOT exempt',
+  isHardRule({ rule: 'MADE-UP', file: 'a.ts', line: 1, title: 't', badCode: 'x as Foo', description: '' }), false)
+// TS-1 is judged on quoted code only: prose is full of `as` and `any`.
+check('the word "any" in PROSE alone is NOT exempt',
+  isHardRule({ rule: 'TS-1', file: 'a.ts', line: 1, title: 'fails on any cart with items', badCode: 'total += lines[i].price', description: 'any agent could trip this' }), false)
+check('the phrase "such as" in prose alone is NOT exempt',
+  isHardRule({ rule: 'TS-1', file: 'a.ts', line: 1, title: 'issue', badCode: 'const n = 1', description: 'a primitive such as String is used' }), false)
+
+console.log('\nhard rules: genuine violations must STILL be exempt')
+check('TS-1 with a real cast',   isHardRule({ rule: 'TS-1', file: 'a.ts', line: 1, title: 'cast', badCode: 'const x = y as Foo;', description: '' }), true)
+check('TS-1 with a real any',    isHardRule({ rule: 'TS-1', file: 'a.ts', line: 1, title: 'any',  badCode: 'function f(x: any) {}', description: '' }), true)
+check('TS-2 with a .js path',    isHardRule({ rule: 'TS-2', file: 'web/thing.js', line: 1, title: 'js added', badCode: '', description: '' }), true)
+check('GQL-1 with a nodes query',isHardRule({ rule: 'GQL-1', file: 'q.graphql', line: 1, title: 'no pageInfo', badCode: 'products { nodes { id } }', description: '' }), true)
+check('PR-1 anchored on the PR title', isHardRule({ rule: 'PR-1', file: 'PR title', line: 1, title: 'missing prefix', badCode: '', description: '' }), true)
+// A cast to a lowercase built-in is as much a TS-1 violation as a cast to a
+// named type. Missing it sent a genuine hard rule to a verifier that cannot
+// answer a policy claim, where it could be dropped.
+for (const cast of ['x as string', 'x as number', 'x as unknown as Foo', 'x as const', 'x as boolean']) {
+  check(`TS-1 corroborated by \`${cast}\``,
+    isHardRule({ rule: 'TS-1', file: 'a.ts', line: 1, title: 'cast', badCode: cast, description: '' }), true)
+}
+check('TS-1 corroborated by an any annotation',
+  isHardRule({ rule: 'TS-1', file: 'a.ts', line: 1, title: 'any', badCode: 'function f(x: any) {}', description: '' }), true)
+check('TS-1 corroborated by an any[] ',
+  isHardRule({ rule: 'TS-1', file: 'a.ts', line: 1, title: 'any', badCode: 'const xs: any[] = []', description: '' }), true)
+
+console.log('\nverification scope by depth')
+const crit = { severity: 'critical' }, imp = { severity: 'important' }, obs = { severity: 'observation' }
+check('scan verifies nothing',            [crit, imp, obs].map(f => shouldVerify(f, 'scan')),   [false, false, false])
+check('medium verifies criticals only',   [crit, imp, obs].map(f => shouldVerify(f, 'medium')), [true, false, false])
+check('deep verifies crit + important',   [crit, imp, obs].map(f => shouldVerify(f, 'deep')),   [true, true, false])
+check('a corroborated hard rule is never verified',
+  shouldVerify({ severity: 'critical', rule: 'TS-2', file: 'x.js', badCode: '', description: '', title: '' }, 'deep'), false)
+
+// Per-host model routing is optional: a deployment may pin models per host via
+// a MODEL_TABLE, or leave every agent() call to name its own model. Test it
+// only when it is present, so this suite runs against either shape.
+const routingAssign = /const\s+MODEL\s*=\s*MODEL_TABLE\s*\[\s*HOST\s*\]/.exec(src)
+const hasRouting = Boolean(routingAssign)
+// A guard that can silently disable itself is worse than no guard. If the file
+// clearly HAS a MODEL_TABLE but the assignment did not parse, that is a failure,
+// not a reason to skip.
+if (!hasRouting && /MODEL_TABLE/.test(src)) {
+  check('MODEL_TABLE is present but its assignment was not recognised', false, true)
+}
+if (!hasRouting) {
+  console.log('\nmodel + effort routing: not configured in this workflow.js, skipped')
+} else {
+  console.log('\nmodel + effort routing is pinned per host, never inherited')
+  const routing = new Function('input', [
+    src.slice(src.indexOf('const HOST = '), routingAssign.index + routingAssign[0].length),
+    'return { HOST, MODEL }',
+  ].join('\n'))
+  check('an absent host arg falls back to the default table', routing({}).MODEL, routing({ host: 'claude' }).MODEL)
+  check('an unknown host falls back to the default, not an invalid model', routing({ host: 'nonsense' }).HOST, 'claude')
+  check('host matching is case-insensitive', routing({ host: 'CODEX' }).HOST, 'codex')
+  // Every role must resolve to a non-empty model, and effort must be set.
+  for (const host of ['claude', 'codex']) {
+    const m = routing({ host }).MODEL
+    const roles = Object.keys(m).filter(k => k !== 'effort')
+    check(`${host}: every role resolves to a model`, roles.every(r => typeof m[r] === 'string' && m[r].length > 0), true)
+    check(`${host}: effort is set`, typeof m.effort === 'string' && m.effort.length > 0, true)
+  }
+}
+
+console.log(failed === 0 ? '\nall checks passed\n' : `\n${failed} check(s) FAILED\n`)
+process.exit(failed === 0 ? 0 : 1)

package/plugins/olko-github-pr/skills/lekker-review/workflow.js

@@ -8,43 +8,68 @@ export const meta = {
 // Schemas
 // ---------------------------------------------------------------------------
 
+const FINDINGS_ARRAY_SCHEMA = {
+  type: 'array',
+  items: {
+    type: 'object',
+    required: ['file', 'line', 'severity', 'title', 'description', 'badCode', 'fix'],
+    properties: {
+      file:        { type: 'string' },
+      line:        { type: 'integer' },
+      severity:    { enum: ['critical', 'important', 'observation', 'idiomatic'] },
+      title:       { type: 'string' },
+      description: { type: 'string' },
+      badCode:     { type: 'string' },
+      fix:         { type: 'string' },
+      precedent:   { type: 'string' },
+      rule:        { type: 'string', minLength: 1, pattern: '\\S' },
+    },
+  },
+}
+
+const MOCK_SMELLS_SCHEMA = {
+  type: 'array',
+  items: {
+    type: 'object',
+    required: ['file', 'line', 'description', 'fix'],
+    properties: {
+      file:        { type: 'string' },
+      line:        { type: 'integer' },
+      description: { type: 'string' },
+      fix:         { type: 'string' },
+    },
+  },
+}
+
 const FINDINGS_SCHEMA = {
   type: 'object',
   required: ['findings'],
   properties: {
-    findings: {
-      type: 'array',
-      items: {
-        type: 'object',
-        required: ['file', 'line', 'severity', 'title', 'description', 'badCode', 'fix'],
-        properties: {
-          file:        { type: 'string' },
-          line:        { type: 'integer' },
-          severity:    { enum: ['critical', 'important', 'observation', 'idiomatic'] },
-          title:       { type: 'string' },
-          description: { type: 'string' },
-          badCode:     { type: 'string' },
-          fix:         { type: 'string' },
-          precedent:   { type: 'string' },
-          rule:        { enum: ['TS-1', 'TS-2', 'GQL-1', 'PR-1'] },
-        },
-      },
-    },
+    findings: FINDINGS_ARRAY_SCHEMA,
     acCoverage:      { type: 'string' },
     mutationSlip:    { type: 'string' },
     coverageVerdict: { type: 'string' },
-    mockSmells: {
-      type: 'array',
-      items: {
-        type: 'object',
-        properties: {
-          file:        { type: 'string' },
-          line:        { type: 'integer' },
-          description: { type: 'string' },
-          fix:         { type: 'string' },
-        },
-      },
-    },
+    mockSmells: MOCK_SMELLS_SCHEMA,
+  },
+}
+
+const IMPLEMENTATION_SCHEMA = {
+  type: 'object',
+  required: ['findings', 'acCoverage'],
+  properties: {
+    findings: FINDINGS_ARRAY_SCHEMA,
+    acCoverage: { type: 'string' },
+  },
+}
+
+const TEST_QUALITY_SCHEMA = {
+  type: 'object',
+  required: ['findings', 'coverageVerdict', 'mutationSlip', 'mockSmells'],
+  properties: {
+    findings: FINDINGS_ARRAY_SCHEMA,
+    coverageVerdict: { type: 'string' },
+    mutationSlip: { type: 'string' },
+    mockSmells: MOCK_SMELLS_SCHEMA,
   },
 }
 
@@ -80,10 +105,11 @@ const CRITIC_SCHEMA = {
 
 const PROOF_SCHEMA = {
   type: 'object',
-  required: ['attempted', 'proven', 'reason'],
+  required: ['attempted', 'proven', 'outcome', 'reason'],
   properties: {
     attempted:   { type: 'boolean' },
     proven:      { type: 'boolean' },
+    outcome:     { enum: ['proven', 'passed', 'inconclusive', 'not_attempted'] },
     reason:      { type: 'string' },
     testCode:    { type: 'string' },
     testCommand: { type: 'string' },
@@ -95,10 +121,8 @@ const PROOF_SCHEMA = {
 // Helpers
 // ---------------------------------------------------------------------------
 
-const HARD_RULES = ['TS-1', 'TS-2', 'GQL-1', 'PR-1']
-
 function isHardRule(finding) {
-  return typeof finding.rule === 'string' && HARD_RULES.indexOf(finding.rule) !== -1
+  return typeof finding.rule === 'string' && finding.rule.trim().length > 0
 }
 
 const SEVERITY_RANK = { critical: 3, important: 2, observation: 1, idiomatic: 0 }
@@ -136,6 +160,13 @@ function mergeFindings(a, b) {
 
   if (SEVERITY_RANK[b.severity] > SEVERITY_RANK[merged.severity]) {
     merged.severity = b.severity
+    for (const field of ['verificationStatus', 'verifierReasoning', 'proof']) {
+      if (Object.prototype.hasOwnProperty.call(b, field)) {
+        merged[field] = b[field]
+      } else {
+        delete merged[field]
+      }
+    }
   }
 
   merged.description = longest(a.description, b.description)
@@ -162,10 +193,43 @@ function mergeFindings(a, b) {
   return merged
 }
 
+// How far apart two anchor lines may be and still count as the same issue.
+// Reviewers routinely anchor one defect at different lines: the loop header,
+// the body, the function signature. Kept tight enough that two genuinely
+// distinct findings in one file are not merged because their titles rhyme.
+const SAME_ISSUE_LINE_WINDOW = 30
+
+function nearbyLines(a, b) {
+  const la = Number(a.line)
+  const lb = Number(b.line)
+  if (!Number.isFinite(la) || !Number.isFinite(lb)) {
+    // A finding with no usable line (a PR-level note) only merges with another
+    // one at the same missing line, which is what strict equality gives.
+    return a.line === b.line
+  }
+  return Math.abs(la - lb) <= SAME_ISSUE_LINE_WINDOW
+}
+
+// Would adding `candidate` keep the whole group inside the window? Uses the
+// group's min and max so the answer never depends on arrival order.
+function spanWithinWindow(group, candidate) {
+  const lines = group.concat([candidate]).map(function(f) { return Number(f.line) })
+  if (!lines.every(function(n) { return Number.isFinite(n) })) {
+    // Any unusable line falls back to the strict pairwise rule.
+    return group.every(function(m) { return nearbyLines(m, candidate) })
+  }
+  return Math.max.apply(null, lines) - Math.min.apply(null, lines) <= SAME_ISSUE_LINE_WINDOW
+}
+
 function dedup(allFindings) {
+  // Bucket by FILE, not by `file:line`. Bucketing on the exact line meant two
+  // reviewers describing one defect at lines 9 and 14 landed in different
+  // buckets, so `sameIssue` was never consulted: the issue was verified twice,
+  // burning two verifier agents and emitting two inline comments for one
+  // problem, which is exactly what this pass exists to prevent.
   const byLocation = new Map()
   for (const f of allFindings) {
-    const key = `${f.file}:${f.line}`
+    const key = String(f.file)
     if (!byLocation.has(key)) {
       byLocation.set(key, [])
     }
@@ -176,7 +240,13 @@ function dedup(allFindings) {
   for (const candidates of byLocation.values()) {
     const groups = []
     for (const candidate of candidates) {
-      const match = groups.find(function(g) { return sameIssue(g[0], candidate) })
+      // Compare against the whole group's SPAN, not just its first member.
+      // Checking only g[0] made grouping order-dependent: findings at 25, 50
+      // and 1 all joined when 25 arrived first, leaving a group spanning 49
+      // lines despite a 30-line window.
+      const match = groups.find(function(g) {
+        return sameIssue(g[0], candidate) && spanWithinWindow(g, candidate)
+      })
       if (match) {
         match.push(candidate)
       } else {
@@ -190,21 +260,51 @@ function dedup(allFindings) {
   return result
 }
 
-function shouldVerify(finding, depth) {
-  // house hard rules are policy violations, not runtime-failure claims. The
-  // five adversarial challenges cannot be answered for them, so verifying
-  // would systematically drop findings that are Critical by policy.
-  if (isHardRule(finding)) {
-    return false
+function shouldVerify(finding) {
+  // Review depth controls breadth, not the trust bar. Every finding that can
+  // affect the verdict must be checked. Hard rules take the verifier's
+  // rule-specific anchor/applicability path instead of its runtime challenges.
+  return finding.severity === 'critical' || finding.severity === 'important'
+}
+
+function normalizeProof(result) {
+  const hasText = function(value) {
+    return typeof value === 'string' && value.trim().length > 0
   }
-  if (depth === 'scan') {
-    return false
+  const coherent = (
+    result.attempted === true
+    && result.proven === true
+    && result.outcome === 'proven'
+    && hasText(result.testCode)
+    && hasText(result.testCommand)
+    && hasText(result.redOutput)
+  ) || (
+    result.attempted === true
+    && result.proven === false
+    && result.outcome === 'passed'
+    && hasText(result.testCode)
+    && hasText(result.testCommand)
+  ) || (
+    result.attempted === true
+    && result.proven === false
+    && result.outcome === 'inconclusive'
+  ) || (
+    result.attempted === false
+    && result.proven === false
+    && result.outcome === 'not_attempted'
+  )
+
+  if (coherent) {
+    return result
   }
-  if (depth === 'medium') {
-    return finding.severity === 'critical'
+
+  const attempted = result.attempted === true
+  return {
+    attempted,
+    proven: false,
+    outcome: attempted ? 'inconclusive' : 'not_attempted',
+    reason: `Prover returned an inconsistent proof state; ignored. ${result.reason || ''}`.trim(),
   }
-  // deep: critical + important
-  return finding.severity === 'critical' || finding.severity === 'important'
 }
 
 // Run thunks in sequential batches, giving the per-finding stages a ceiling.
@@ -345,6 +445,7 @@ const budgetAtStart = budget.spent()
       `Read and follow ${promptDir}/verifier.md.`,
       `FINDING (JSON): ${JSON.stringify(finding)}.`,
       `DIFF_FILE=${diffFile}, CONTEXT_FILE=${contextFile}, WORKTREE_PATH=${wtDisplay}.`,
+      `HOUSE_RULES_FILE: read key "houseRulesFile" from CONTEXT_FILE, then read that exact path before validating a hard rule.`,
       `Default to dropping when uncertain.`,
     ].join(' ')
   }
@@ -355,16 +456,22 @@ const budgetAtStart = budget.spent()
 
   async function reviewStage(dim) {
     agentCount++
+    let schema = FINDINGS_SCHEMA
+    if (dim.key === 'implementation') {
+      schema = IMPLEMENTATION_SCHEMA
+    } else if (dim.key === 'test-quality') {
+      schema = TEST_QUALITY_SCHEMA
+    }
     const result = await agent(reviewPrompt(dim), {
       label:  `review:${dim.key}`,
       phase:  'Review',
-      schema: FINDINGS_SCHEMA,
+      schema,
       model:  dim.model,
     })
 
     if (!result) {
       log(`${dim.key}: agent returned null, skipping`)
-      return []
+      return { key: dim.key, findings: [] }
     }
 
     const findings = (result.findings || []).map(function(f) {
@@ -374,44 +481,45 @@ const budgetAtStart = budget.spent()
     })
 
     log(`${dim.key}: ${findings.length} findings, ${
-      findings.filter(function(f) { return shouldVerify(f, depth) }).length
+      findings.filter(function(f) { return shouldVerify(f) }).length
     } to verify`)
 
-    return findings
+    return {
+      key: dim.key,
+      findings,
+      acCoverage: dim.key === 'implementation' ? result.acCoverage : undefined,
+      coverageVerdict: dim.key === 'test-quality' ? result.coverageVerdict : undefined,
+      mutationSlip: dim.key === 'test-quality' ? result.mutationSlip : undefined,
+      mockSmells: dim.key === 'test-quality' ? result.mockSmells : undefined,
+    }
   }
 
   // -------------------------------------------------------------------------
   // Verify stage: takes the deduped cross-dimension finding set, splits into
-  // in-scope (adversarially verified) and out-of-scope (kept as-is, including
-  // house hard rules which are exempt by policy), and runs verifiers in
-  // parallel over the in-scope set.
+  // in-scope (verdict-affecting) and out-of-scope (non-blocking), and runs
+  // verifiers in parallel over the in-scope set. Hard rules use the verifier's
+  // rule-specific checks and skip only its runtime-oriented challenges.
   // -------------------------------------------------------------------------
 
   async function verifyAll(findings) {
     const inScope = findings.filter(function(f) {
-      return shouldVerify(f, depth)
+      return shouldVerify(f)
     })
     const outOfScope = findings.filter(function(f) {
-      return !shouldVerify(f, depth)
-    })
-
-    const exempted = outOfScope.map(function(f) {
-      if (!isHardRule(f)) {
-        return f
-      }
-      hardRuleCount++
-      const exempt = Object.assign({}, f)
-      exempt.verifierReasoning = `hard rule ${f.rule}: exempt from adversarial verification (standards violation, not a runtime-failure claim)`
-      return exempt
+      return !shouldVerify(f)
     })
 
     if (inScope.length === 0) {
-      return exempted
+      return outOfScope
     }
 
     const verified = await batched(inScope.map(function(finding) {
       return async function() {
         agentCount++
+        if (isHardRule(finding)) {
+          hardRuleCount++
+        }
+
         const verdict = await agent(verifierPrompt(finding), {
           label:  `verify:${finding.file}:${finding.line}`,
           model:  'sonnet',
@@ -421,9 +529,12 @@ const budgetAtStart = budget.spent()
         })
 
         if (!verdict) {
-          // Null agent result: treat as confirmed-unverified
+          // Missing verification cannot support a blocking finding.
+          downgradedCount++
           const kept = Object.assign({}, finding)
-          kept.verifierReasoning = 'verifier agent returned null; kept unverified'
+          kept.severity = 'observation'
+          kept.verificationStatus = 'unavailable'
+          kept.verifierReasoning = 'verifier agent returned no usable result; downgraded to non-blocking'
           return kept
         }
 
@@ -436,18 +547,20 @@ const budgetAtStart = budget.spent()
           downgradedCount++
           const downgraded = Object.assign({}, finding)
           downgraded.severity = verdict.newSeverity || 'observation'
+          downgraded.verificationStatus = 'downgraded'
           downgraded.verifierReasoning = verdict.reasoning
           return downgraded
         }
 
         // confirmed
         const confirmed = Object.assign({}, finding)
+        confirmed.verificationStatus = isHardRule(finding) ? 'hard-rule-confirmed' : 'confirmed'
         confirmed.verifierReasoning = verdict.reasoning
         return confirmed
       }
     }), FANOUT_PLAN)
 
-    return exempted.concat(verified.filter(Boolean))
+    return outOfScope.concat(verified.filter(Boolean))
   }
 
   // -------------------------------------------------------------------------
@@ -465,10 +578,19 @@ const budgetAtStart = budget.spent()
     return function() { return reviewStage(dim) }
   }), REVIEW_PLAN)
 
-  const deduped = dedup(reviewed.filter(Boolean).flat())
+  const reviewResults = reviewed.filter(Boolean)
+  const implementationResult = reviewResults.find(function(result) {
+    return result.key === 'implementation'
+  }) || {}
+  const testQualityResult = reviewResults.find(function(result) {
+    return result.key === 'test-quality'
+  }) || {}
+  const deduped = dedup(reviewResults.flatMap(function(result) {
+    return result.findings
+  }))
 
   log(`${deduped.length} unique finding(s) after dedup; verifying ${
-    deduped.filter(function(f) { return shouldVerify(f, depth) }).length
+    deduped.filter(function(f) { return shouldVerify(f) }).length
   }`)
 
   phase('Verify')
@@ -552,11 +674,17 @@ const budgetAtStart = budget.spent()
             return []
           }
 
+          if (isHardRule(newFinding)) {
+            hardRuleCount++
+          }
+
           if (verdict.verdict === 'downgraded') {
             downgradedCount++
             newFinding.severity = verdict.newSeverity || 'observation'
+            newFinding.verificationStatus = 'downgraded'
             newFinding.verifierReasoning = verdict.reasoning
           } else {
+            newFinding.verificationStatus = isHardRule(newFinding) ? 'hard-rule-confirmed' : 'confirmed'
             newFinding.verifierReasoning = verdict.reasoning
           }
 
@@ -622,9 +750,19 @@ const budgetAtStart = budget.spent()
             return
           }
 
-          finding.proof = result
-          if (result.proven === true) {
+          const proof = normalizeProof(result)
+          finding.proof = proof
+          if (proof.proven === true) {
             provenCount++
+            finding.verificationStatus = 'proven'
+          } else if (proof.outcome === 'passed') {
+            downgradedCount++
+            finding.severity = 'important'
+            finding.verificationStatus = 'counter-evidence'
+            finding.verifierReasoning = [
+              finding.verifierReasoning,
+              `Proof test passed: ${proof.reason}`,
+            ].filter(Boolean).join(' ')
           }
         }
       }), FANOUT_PLAN)
@@ -648,6 +786,10 @@ const budgetAtStart = budget.spent()
     agentCount,
     proveAttemptCount,
     provenCount,
+    acCoverage:        implementationResult.acCoverage || null,
+    coverageVerdict:   testQualityResult.coverageVerdict || null,
+    mutationSlip:      testQualityResult.mutationSlip || null,
+    mockSmells:        Array.isArray(testQualityResult.mockSmells) ? testQualityResult.mockSmells : [],
     outputTokens:      budget.spent() - budgetAtStart,
     turnTokensTotal:   budget.spent(),
   }

package/plugins/olko-obsidian/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-obsidian",
   "description": "Keep an Obsidian vault in sync with work: PR sync, task rollover, morning routine.",
-  "version": "1.40.0",
+  "version": "1.41.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-product/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-product",
   "description": "Take a product idea to a shippable build: MVP passes, full-stack scaffolds, launch plans.",
-  "version": "1.40.0",
+  "version": "1.41.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-reflection/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-reflection",
   "description": "Look back and improve: self-critique, retrospectives, performance review, rapid learning.",
-  "version": "1.40.0",
+  "version": "1.41.0",
   "author": {
     "name": "Oleg Koval"
   },