@olegkoval/agent-skills 1.40.1 → 1.41.0

package/plugins/olko-github-pr/skills/lekker-review/workflow.js

@@ -8,43 +8,68 @@ export const meta = {
 // Schemas
 // ---------------------------------------------------------------------------
 
+const FINDINGS_ARRAY_SCHEMA = {
+  type: 'array',
+  items: {
+    type: 'object',
+    required: ['file', 'line', 'severity', 'title', 'description', 'badCode', 'fix'],
+    properties: {
+      file:        { type: 'string' },
+      line:        { type: 'integer' },
+      severity:    { enum: ['critical', 'important', 'observation', 'idiomatic'] },
+      title:       { type: 'string' },
+      description: { type: 'string' },
+      badCode:     { type: 'string' },
+      fix:         { type: 'string' },
+      precedent:   { type: 'string' },
+      rule:        { type: 'string', minLength: 1, pattern: '\\S' },
+    },
+  },
+}
+
+const MOCK_SMELLS_SCHEMA = {
+  type: 'array',
+  items: {
+    type: 'object',
+    required: ['file', 'line', 'description', 'fix'],
+    properties: {
+      file:        { type: 'string' },
+      line:        { type: 'integer' },
+      description: { type: 'string' },
+      fix:         { type: 'string' },
+    },
+  },
+}
+
 const FINDINGS_SCHEMA = {
   type: 'object',
   required: ['findings'],
   properties: {
-    findings: {
-      type: 'array',
-      items: {
-        type: 'object',
-        required: ['file', 'line', 'severity', 'title', 'description', 'badCode', 'fix'],
-        properties: {
-          file:        { type: 'string' },
-          line:        { type: 'integer' },
-          severity:    { enum: ['critical', 'important', 'observation', 'idiomatic'] },
-          title:       { type: 'string' },
-          description: { type: 'string' },
-          badCode:     { type: 'string' },
-          fix:         { type: 'string' },
-          precedent:   { type: 'string' },
-          rule:        { enum: ['TS-1', 'TS-2', 'GQL-1', 'PR-1'] },
-        },
-      },
-    },
+    findings: FINDINGS_ARRAY_SCHEMA,
     acCoverage:      { type: 'string' },
     mutationSlip:    { type: 'string' },
     coverageVerdict: { type: 'string' },
-    mockSmells: {
-      type: 'array',
-      items: {
-        type: 'object',
-        properties: {
-          file:        { type: 'string' },
-          line:        { type: 'integer' },
-          description: { type: 'string' },
-          fix:         { type: 'string' },
-        },
-      },
-    },
+    mockSmells: MOCK_SMELLS_SCHEMA,
+  },
+}
+
+const IMPLEMENTATION_SCHEMA = {
+  type: 'object',
+  required: ['findings', 'acCoverage'],
+  properties: {
+    findings: FINDINGS_ARRAY_SCHEMA,
+    acCoverage: { type: 'string' },
+  },
+}
+
+const TEST_QUALITY_SCHEMA = {
+  type: 'object',
+  required: ['findings', 'coverageVerdict', 'mutationSlip', 'mockSmells'],
+  properties: {
+    findings: FINDINGS_ARRAY_SCHEMA,
+    coverageVerdict: { type: 'string' },
+    mutationSlip: { type: 'string' },
+    mockSmells: MOCK_SMELLS_SCHEMA,
   },
 }
 
@@ -80,10 +105,11 @@ const CRITIC_SCHEMA = {
 
 const PROOF_SCHEMA = {
   type: 'object',
-  required: ['attempted', 'proven', 'reason'],
+  required: ['attempted', 'proven', 'outcome', 'reason'],
   properties: {
     attempted:   { type: 'boolean' },
     proven:      { type: 'boolean' },
+    outcome:     { enum: ['proven', 'passed', 'inconclusive', 'not_attempted'] },
     reason:      { type: 'string' },
     testCode:    { type: 'string' },
     testCommand: { type: 'string' },
@@ -95,54 +121,8 @@ const PROOF_SCHEMA = {
 // Helpers
 // ---------------------------------------------------------------------------
 
-const HARD_RULES = ['TS-1', 'TS-2', 'GQL-1', 'PR-1']
-
-// Does the finding's OWN evidence corroborate the hard rule it claims?
-//
-// A `rule` tag is worth a lot: it preserves Critical severity AND skips
-// adversarial verification. Nothing used to check that the tag matched the
-// finding, so any reviewer agent could bypass the verifier by writing
-// `rule: "TS-1"`. Seen in practice: a missing-test-coverage finding and a
-// comment-policy finding were both tagged TS-1, which is about `as X` casts
-// and `any`, and both shipped Critical and unverified.
-//
-// An uncorroborated tag does NOT lose its severity here; it simply stops being
-// exempt, so the verifier weighs it like any other finding. That is the
-// conservative direction: unproven claims get scrutiny, not a free pass.
-function hardRuleCorroborated(finding) {
-  const evidence = [finding.badCode, finding.description, finding.title]
-    .map(function(x) { return String(x || '') }).join('\n')
-  const file = String(finding.file || '')
-  // TS-1 is judged on the QUOTED CODE only. Prose is full of the words `as` and
-  // `any` ("any cart with items"), and matching those re-opened the very bypass
-  // this function exists to close.
-  const code = String(finding.badCode || '')
-
-  switch (finding.rule) {
-    case 'TS-1':
-      // A cast to a capitalised type OR to a lowercase built-in: `as string`
-      // is every bit as much a TS-1 violation as `as Foo`, and missing it sent
-      // a genuine hard-rule finding to a verifier whose five challenges cannot
-      // answer a standards claim, where it could be dropped outright.
-      return /\bas\s+(?:[A-Z_$][\w$]*|string|number|boolean|bigint|symbol|object|unknown|never|any|const)\b/.test(code)
-        || /:\s*any\b|<\s*any[\s,>]|\bany\[\]/.test(code)
-    case 'TS-2':
-      return /\.js$/.test(file)
-    case 'GQL-1':
-      return /\bnodes\b|\bpageInfo\b|\bedges\b/.test(evidence)
-    case 'PR-1':
-      // PR-1 is about the PR title, so it has no source file to anchor to.
-      return /pr\s*(title|description)/i.test(file + '\n' + evidence)
-    default:
-      return false
-  }
-}
-
 function isHardRule(finding) {
-  if (typeof finding.rule !== 'string' || HARD_RULES.indexOf(finding.rule) === -1) {
-    return false
-  }
-  return hardRuleCorroborated(finding)
+  return typeof finding.rule === 'string' && finding.rule.trim().length > 0
 }
 
 const SEVERITY_RANK = { critical: 3, important: 2, observation: 1, idiomatic: 0 }
@@ -180,6 +160,13 @@ function mergeFindings(a, b) {
 
   if (SEVERITY_RANK[b.severity] > SEVERITY_RANK[merged.severity]) {
     merged.severity = b.severity
+    for (const field of ['verificationStatus', 'verifierReasoning', 'proof']) {
+      if (Object.prototype.hasOwnProperty.call(b, field)) {
+        merged[field] = b[field]
+      } else {
+        delete merged[field]
+      }
+    }
   }
 
   merged.description = longest(a.description, b.description)
@@ -273,21 +260,51 @@ function dedup(allFindings) {
   return result
 }
 
-function shouldVerify(finding, depth) {
-  // house hard rules are policy violations, not runtime-failure claims. The
-  // five adversarial challenges cannot be answered for them, so verifying
-  // would systematically drop findings that are Critical by policy.
-  if (isHardRule(finding)) {
-    return false
+function shouldVerify(finding) {
+  // Review depth controls breadth, not the trust bar. Every finding that can
+  // affect the verdict must be checked. Hard rules take the verifier's
+  // rule-specific anchor/applicability path instead of its runtime challenges.
+  return finding.severity === 'critical' || finding.severity === 'important'
+}
+
+function normalizeProof(result) {
+  const hasText = function(value) {
+    return typeof value === 'string' && value.trim().length > 0
   }
-  if (depth === 'scan') {
-    return false
+  const coherent = (
+    result.attempted === true
+    && result.proven === true
+    && result.outcome === 'proven'
+    && hasText(result.testCode)
+    && hasText(result.testCommand)
+    && hasText(result.redOutput)
+  ) || (
+    result.attempted === true
+    && result.proven === false
+    && result.outcome === 'passed'
+    && hasText(result.testCode)
+    && hasText(result.testCommand)
+  ) || (
+    result.attempted === true
+    && result.proven === false
+    && result.outcome === 'inconclusive'
+  ) || (
+    result.attempted === false
+    && result.proven === false
+    && result.outcome === 'not_attempted'
+  )
+
+  if (coherent) {
+    return result
   }
-  if (depth === 'medium') {
-    return finding.severity === 'critical'
+
+  const attempted = result.attempted === true
+  return {
+    attempted,
+    proven: false,
+    outcome: attempted ? 'inconclusive' : 'not_attempted',
+    reason: `Prover returned an inconsistent proof state; ignored. ${result.reason || ''}`.trim(),
   }
-  // deep: critical + important
-  return finding.severity === 'critical' || finding.severity === 'important'
 }
 
 // Run thunks in sequential batches, giving the per-finding stages a ceiling.
@@ -428,6 +445,7 @@ const budgetAtStart = budget.spent()
       `Read and follow ${promptDir}/verifier.md.`,
       `FINDING (JSON): ${JSON.stringify(finding)}.`,
       `DIFF_FILE=${diffFile}, CONTEXT_FILE=${contextFile}, WORKTREE_PATH=${wtDisplay}.`,
+      `HOUSE_RULES_FILE: read key "houseRulesFile" from CONTEXT_FILE, then read that exact path before validating a hard rule.`,
       `Default to dropping when uncertain.`,
     ].join(' ')
   }
@@ -438,16 +456,22 @@ const budgetAtStart = budget.spent()
 
   async function reviewStage(dim) {
     agentCount++
+    let schema = FINDINGS_SCHEMA
+    if (dim.key === 'implementation') {
+      schema = IMPLEMENTATION_SCHEMA
+    } else if (dim.key === 'test-quality') {
+      schema = TEST_QUALITY_SCHEMA
+    }
     const result = await agent(reviewPrompt(dim), {
       label:  `review:${dim.key}`,
       phase:  'Review',
-      schema: FINDINGS_SCHEMA,
+      schema,
       model:  dim.model,
     })
 
     if (!result) {
       log(`${dim.key}: agent returned null, skipping`)
-      return []
+      return { key: dim.key, findings: [] }
     }
 
     const findings = (result.findings || []).map(function(f) {
@@ -457,44 +481,45 @@ const budgetAtStart = budget.spent()
     })
 
     log(`${dim.key}: ${findings.length} findings, ${
-      findings.filter(function(f) { return shouldVerify(f, depth) }).length
+      findings.filter(function(f) { return shouldVerify(f) }).length
     } to verify`)
 
-    return findings
+    return {
+      key: dim.key,
+      findings,
+      acCoverage: dim.key === 'implementation' ? result.acCoverage : undefined,
+      coverageVerdict: dim.key === 'test-quality' ? result.coverageVerdict : undefined,
+      mutationSlip: dim.key === 'test-quality' ? result.mutationSlip : undefined,
+      mockSmells: dim.key === 'test-quality' ? result.mockSmells : undefined,
+    }
   }
 
   // -------------------------------------------------------------------------
   // Verify stage: takes the deduped cross-dimension finding set, splits into
-  // in-scope (adversarially verified) and out-of-scope (kept as-is, including
-  // house hard rules which are exempt by policy), and runs verifiers in
-  // parallel over the in-scope set.
+  // in-scope (verdict-affecting) and out-of-scope (non-blocking), and runs
+  // verifiers in parallel over the in-scope set. Hard rules use the verifier's
+  // rule-specific checks and skip only its runtime-oriented challenges.
   // -------------------------------------------------------------------------
 
   async function verifyAll(findings) {
     const inScope = findings.filter(function(f) {
-      return shouldVerify(f, depth)
+      return shouldVerify(f)
     })
     const outOfScope = findings.filter(function(f) {
-      return !shouldVerify(f, depth)
-    })
-
-    const exempted = outOfScope.map(function(f) {
-      if (!isHardRule(f)) {
-        return f
-      }
-      hardRuleCount++
-      const exempt = Object.assign({}, f)
-      exempt.verifierReasoning = `hard rule ${f.rule}: exempt from adversarial verification (standards violation, not a runtime-failure claim)`
-      return exempt
+      return !shouldVerify(f)
     })
 
     if (inScope.length === 0) {
-      return exempted
+      return outOfScope
     }
 
     const verified = await batched(inScope.map(function(finding) {
       return async function() {
         agentCount++
+        if (isHardRule(finding)) {
+          hardRuleCount++
+        }
+
         const verdict = await agent(verifierPrompt(finding), {
           label:  `verify:${finding.file}:${finding.line}`,
           model:  'sonnet',
@@ -504,9 +529,12 @@ const budgetAtStart = budget.spent()
         })
 
         if (!verdict) {
-          // Null agent result: treat as confirmed-unverified
+          // Missing verification cannot support a blocking finding.
+          downgradedCount++
           const kept = Object.assign({}, finding)
-          kept.verifierReasoning = 'verifier agent returned null; kept unverified'
+          kept.severity = 'observation'
+          kept.verificationStatus = 'unavailable'
+          kept.verifierReasoning = 'verifier agent returned no usable result; downgraded to non-blocking'
           return kept
         }
 
@@ -519,18 +547,20 @@ const budgetAtStart = budget.spent()
           downgradedCount++
           const downgraded = Object.assign({}, finding)
           downgraded.severity = verdict.newSeverity || 'observation'
+          downgraded.verificationStatus = 'downgraded'
           downgraded.verifierReasoning = verdict.reasoning
           return downgraded
         }
 
         // confirmed
         const confirmed = Object.assign({}, finding)
+        confirmed.verificationStatus = isHardRule(finding) ? 'hard-rule-confirmed' : 'confirmed'
         confirmed.verifierReasoning = verdict.reasoning
         return confirmed
       }
     }), FANOUT_PLAN)
 
-    return exempted.concat(verified.filter(Boolean))
+    return outOfScope.concat(verified.filter(Boolean))
   }
 
   // -------------------------------------------------------------------------
@@ -548,10 +578,19 @@ const budgetAtStart = budget.spent()
     return function() { return reviewStage(dim) }
   }), REVIEW_PLAN)
 
-  const deduped = dedup(reviewed.filter(Boolean).flat())
+  const reviewResults = reviewed.filter(Boolean)
+  const implementationResult = reviewResults.find(function(result) {
+    return result.key === 'implementation'
+  }) || {}
+  const testQualityResult = reviewResults.find(function(result) {
+    return result.key === 'test-quality'
+  }) || {}
+  const deduped = dedup(reviewResults.flatMap(function(result) {
+    return result.findings
+  }))
 
   log(`${deduped.length} unique finding(s) after dedup; verifying ${
-    deduped.filter(function(f) { return shouldVerify(f, depth) }).length
+    deduped.filter(function(f) { return shouldVerify(f) }).length
   }`)
 
   phase('Verify')
@@ -635,11 +674,17 @@ const budgetAtStart = budget.spent()
             return []
           }
 
+          if (isHardRule(newFinding)) {
+            hardRuleCount++
+          }
+
           if (verdict.verdict === 'downgraded') {
             downgradedCount++
             newFinding.severity = verdict.newSeverity || 'observation'
+            newFinding.verificationStatus = 'downgraded'
             newFinding.verifierReasoning = verdict.reasoning
           } else {
+            newFinding.verificationStatus = isHardRule(newFinding) ? 'hard-rule-confirmed' : 'confirmed'
             newFinding.verifierReasoning = verdict.reasoning
           }
 
@@ -705,9 +750,19 @@ const budgetAtStart = budget.spent()
             return
           }
 
-          finding.proof = result
-          if (result.proven === true) {
+          const proof = normalizeProof(result)
+          finding.proof = proof
+          if (proof.proven === true) {
             provenCount++
+            finding.verificationStatus = 'proven'
+          } else if (proof.outcome === 'passed') {
+            downgradedCount++
+            finding.severity = 'important'
+            finding.verificationStatus = 'counter-evidence'
+            finding.verifierReasoning = [
+              finding.verifierReasoning,
+              `Proof test passed: ${proof.reason}`,
+            ].filter(Boolean).join(' ')
           }
         }
       }), FANOUT_PLAN)
@@ -731,6 +786,10 @@ const budgetAtStart = budget.spent()
     agentCount,
     proveAttemptCount,
     provenCount,
+    acCoverage:        implementationResult.acCoverage || null,
+    coverageVerdict:   testQualityResult.coverageVerdict || null,
+    mutationSlip:      testQualityResult.mutationSlip || null,
+    mockSmells:        Array.isArray(testQualityResult.mockSmells) ? testQualityResult.mockSmells : [],
     outputTokens:      budget.spent() - budgetAtStart,
     turnTokensTotal:   budget.spent(),
   }

package/plugins/olko-obsidian/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-obsidian",
   "description": "Keep an Obsidian vault in sync with work: PR sync, task rollover, morning routine.",
-  "version": "1.40.1",
+  "version": "1.41.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-product/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-product",
   "description": "Take a product idea to a shippable build: MVP passes, full-stack scaffolds, launch plans.",
-  "version": "1.40.1",
+  "version": "1.41.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-reflection/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-reflection",
   "description": "Look back and improve: self-critique, retrospectives, performance review, rapid learning.",
-  "version": "1.40.1",
+  "version": "1.41.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-reflection/skills/self-critique/scripts/critique-nudge.mjs

@@ -11,6 +11,9 @@ import { readFileSync } from 'node:fs';
 const THRESHOLD = 1500;
 const OFFER_MARKER = /critical-thinking review/i; // the offer line must contain this; doubles as a loop guard
 
+/**
+ * Exits the hook cleanly when conditions for offering a critique are not met.
+ */
 function bail() { process.exit(0); } // any uncertainty => do nothing, never block the user
 
 let raw = '';

package/plugins/olko-release/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-release",
   "description": "Ship a release: semantic-release setup, changelogs, store listing copy, release-day routine.",
-  "version": "1.40.1",
+  "version": "1.41.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-release/skills/open-source-publisher/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: open-source-publisher
-description: Prepare an open-source repository for polished public publishing. Use when a user asks to publish, open-source, launch, polish, package, brand, or make a GitHub project presentable with a minimal project icon, social preview image, GitHub Pages landing page, standardized README, essential shields, CI/CD quality gates, release automation checks, and optional donation setup. Prefer the external `logo-generator` skill for icon generation when available, and `nolangz/pixel2motion` for optional motion previews of generated static images.
+description: Prepare an open-source repository for polished public publishing. Use when a user asks to publish, open-source, launch, polish, package, brand, or make a GitHub project presentable with a minimal project icon, social preview image, GitHub Pages landing page, standardized README, essential shields, CI/CD quality gates, release automation checks, and optional donation setup. Prefer the external `logo-generator` skill for icon generation when available, and `nolangz/pixel2motion` for optional motion previews of supported logos or simple artwork.
 license: MIT
 allowed-tools: Bash, Read, Write, Edit, WebSearch, WebFetch
 compatibility: Codex, Claude Code, Cursor, GitHub Copilot, Windsurf, Kiro, and other Agent Skills compatible tools. Requires a writable git repository; browser or image rendering tools are useful for visual validation.
@@ -43,12 +43,11 @@ Use this skill to audit whether an OSS repository is ready to publish, then help
 5. For existing usable pieces, do not propose replacement by default. Ask a change-oriented question only when useful, for example:
    - "You already have a terminal-style GitHub Pages site. Do you want to keep it or restyle it?"
    - "You already have an icon and social card. Do you want a refresh, or should I leave them as-is?"
-   - "You already have a static social card. Do you want me to animate it with pixel2motion, or leave it static?"
    - "You already have release automation. Do you want me to audit only, or also tighten it?"
 6. Ask only for choices needed to fix missing or weak pieces:
    - If GitHub Pages is missing or weak, ask for style: `oldschool linux`, `terminal`, `modern`, `brutalist`, `glassmorphism`, `y2k`, `hacker`, or custom.
    - If donation wiring is missing, ask whether to enable it: `none`, `GitHub Sponsors`, `Ko-fi`, `Buy Me a Coffee`, `Open Collective`, `Thanks.dev`, or custom URL.
-   - If the repo has a generated static social image or hero card, ask whether to animate it using `nolangz/pixel2motion`.
+   - If the repo has a generated logo or simple hero artwork supported by `nolangz/pixel2motion`, ask whether to animate it or leave it static.
    - If the repo has no clear product essence, ask for a one-sentence positioning statement.
 7. Implement only approved, missing, or weak work in this order:
    - OSS governance and support files
@@ -212,8 +211,8 @@ Use `magick` or another renderer when `rsvg-convert` is unavailable.
 
 Some repos benefit from a short animated preview. Keep this opt-in.
 
-- If you already generated a static image, ask: `Do you want me to animate the static image using pixel2motion?`
-- If the user says yes, use `nolangz/pixel2motion` as the optional dependency for logo animation, animated HTML demos, and GIF/video previews.
+- After the user opts in during workflow step 6, animate only the approved generated logo or simple artwork.
+- Use `nolangz/pixel2motion` as the optional dependency for that animation, animated HTML demos, and GIF/video previews.
 - Do not auto-animate by default.
 
 ## README Standard

package/plugins/olko-skill-meta/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-skill-meta",
   "description": "Author and maintain agent skills and the AI toolchain itself.",
-  "version": "1.40.1",
+  "version": "1.41.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-web-ops/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-web-ops",
   "description": "Operate a website: WAF rules, search console audits, analytics bootstrap, docs indexes.",
-  "version": "1.40.1",
+  "version": "1.41.0",
   "author": {
     "name": "Oleg Koval"
   },

package/scripts/lib/catalog.mjs

@@ -54,6 +54,9 @@ export const PLUGIN_ASSIGNMENT = {
   },
 }
 
+/**
+ * Loads and parses the skills catalog from the specified JSON file.
+ */
 export function loadCatalog(catalogPath = 'catalog/skills.json') {
   const raw = JSON.parse(readFileSync(catalogPath, 'utf8'))
   const plugins = raw.plugins || []