@olegkoval/agent-skills 1.49.2 → 1.51.0

package/plugins/olko-github-pr/skills/lekker-review/workflow.js

@@ -8,11 +8,30 @@ export const meta = {
 // Schemas
 // ---------------------------------------------------------------------------
 
+const BOUNDARY_SCHEMA = {
+  type: 'object',
+  required: ['entryPoint', 'consumer'],
+  properties: {
+    entryPoint:         { type: 'string', minLength: 1, pattern: '\\S' },
+    decisionPoint:       { type: 'string' },
+    realizationPoint:   { type: 'string' },
+    consumer:           { type: 'string', minLength: 1, pattern: '\\S' },
+    stateOwner:         { type: 'string' },
+    evidenceClass:      { type: 'string' },
+    identityDimensions: { type: 'array', items: { type: 'string' } },
+    transitions:        { type: 'array', items: { type: 'string' } },
+  },
+}
+
 const FINDINGS_ARRAY_SCHEMA = {
   type: 'array',
   items: {
     type: 'object',
     required: ['file', 'line', 'severity', 'title', 'description', 'badCode', 'fix'],
+    anyOf: [
+      { properties: { severity: { enum: ['observation', 'idiomatic'] } } },
+      { required: ['boundary'] },
+    ],
     properties: {
       file:        { type: 'string' },
       line:        { type: 'integer' },
@@ -23,6 +42,7 @@ const FINDINGS_ARRAY_SCHEMA = {
       fix:         { type: 'string' },
       precedent:   { type: 'string' },
       rule:        { type: 'string', minLength: 1, pattern: '\\S' },
+      boundary:    BOUNDARY_SCHEMA,
     },
   },
 }
@@ -267,6 +287,41 @@ function shouldVerify(finding) {
   return finding.severity === 'critical' || finding.severity === 'important'
 }
 
+/**
+ * Does the finding carry enough of a composed boundary map to attempt a
+ * proof? Requires an entry point and a consumer, plus at least one of a
+ * realization point, state owner, or recorded transition.
+ */
+function hasBoundaryProofSurface(finding) {
+  const boundary = finding && finding.boundary
+  if (!boundary || typeof boundary !== 'object') {
+    return false
+  }
+  const hasText = function(value) {
+    return typeof value === 'string' && value.trim().length > 0
+  }
+  const hasList = function(value) {
+    return Array.isArray(value) && value.length > 0
+  }
+  return hasText(boundary.entryPoint)
+    && hasText(boundary.consumer)
+    && (
+      hasText(boundary.realizationPoint)
+      || hasText(boundary.stateOwner)
+      || hasList(boundary.transitions)
+    )
+}
+
+/**
+ * Does this finding qualify for the Prove stage? Every Critical finding
+ * qualifies; an Important finding only qualifies when it has a composed
+ * boundary map to prove against.
+ */
+function shouldProve(finding) {
+  return finding.severity === 'critical'
+    || (finding.severity === 'important' && hasBoundaryProofSurface(finding))
+}
+
 function normalizeProof(result) {
   const hasText = function(value) {
     return typeof value === 'string' && value.trim().length > 0
@@ -520,7 +575,29 @@ const budgetAtStart = budget.spent()
   // rule-specific checks and skip only its runtime-oriented challenges.
   // -------------------------------------------------------------------------
 
+  // A model verdict cannot replace the required production boundary map.
+  function enforceBoundary(finding) {
+    if (!shouldVerify(finding)) return finding
+    const boundary = finding.boundary
+    const hasText = function(value) {
+      return typeof value === 'string' && value.trim().length > 0
+    }
+    if (boundary && typeof boundary === 'object' && !Array.isArray(boundary)
+        && hasText(boundary.entryPoint) && hasText(boundary.consumer)) {
+      return finding
+    }
+    downgradedCount++
+    const unverified = Object.assign({}, finding, {
+      severity: 'observation',
+      verificationStatus: 'unverified',
+      verifierReasoning: 'Missing boundary object or identified production entry point/downstream consumer; downgraded to non-blocking',
+    })
+    delete unverified.proof
+    return unverified
+  }
+
   async function verifyAll(findings) {
+    findings = findings.map(enforceBoundary)
     const inScope = findings.filter(function(f) {
       return shouldVerify(f)
     })
@@ -704,7 +781,8 @@ const budgetAtStart = budget.spent()
           }
 
           // Verify the new finding through the same verifier path
-          const newFinding = Object.assign({}, reResult.findings[0])
+          const newFinding = enforceBoundary(Object.assign({}, reResult.findings[0]))
+          if (newFinding.verificationStatus === 'unverified') return [newFinding]
           newFinding._dimension = `critic:${angle.axis}`
 
           agentCount++
@@ -749,9 +827,13 @@ const budgetAtStart = budget.spent()
 
   } // end ENGINE === 'workflow' branch
 
+  // Recheck after critic dedup and imported results, before proof promotion.
+  finalFindings = finalFindings.map(enforceBoundary)
+
   // -------------------------------------------------------------------------
-  // Prove: for each Critical finding (excluding hard rules, which are policy
-  // violations with no runtime failure to demonstrate), attempt to produce an
+  // Prove: for each Critical finding and each Important finding with a
+  // composed boundary map (excluding hard rules, which are policy violations
+  // with no runtime failure to demonstrate), attempt to produce an
   // executable failing test in the worktree. Only runs with a worktree and
   // outside scan depth, and is capped so a pathological finding count can't
   // blow the budget.
@@ -770,7 +852,7 @@ const budgetAtStart = budget.spent()
 
   if (worktreePath && depth !== 'scan') {
     const proveCandidates = finalFindings.filter(function(f) {
-      return f.severity === 'critical' && !isHardRule(f)
+      return shouldProve(f) && !isHardRule(f)
     })
 
     if (proveCandidates.length > 0) {
@@ -779,7 +861,7 @@ const budgetAtStart = budget.spent()
       const capped = proveCandidates.slice(0, 5)
       const skipped = proveCandidates.length - capped.length
       if (skipped > 0) {
-        log(`Prove: capping at 5 provers, skipping ${skipped} additional critical finding(s)`)
+        log(`Prove: capping at 5 provers, skipping ${skipped} additional finding(s)`)
       }
 
       await batched(capped.map(function(finding) {

package/plugins/olko-github-pr/skills/qodoloop/SKILL.md

@@ -8,7 +8,7 @@ description: >
   addressed against Qodo's review, or says "run qodoloop" / "satisfy Qodo" / "resolve Qodo comments".
 compatibility: Requires git and gh (GitHub CLI) authenticated, with Qodo Merge installed on the repo.
 metadata:
-  version: "1.0"
+  version: "1.1"
 allowed-tools: Bash(gh:*) Bash(git:*)
 ---
 
@@ -85,6 +85,14 @@ Run the paginated GraphQL query in `references/graphql-queries.md` (`unresolvedQ
 
 Build the working set: all `recommended` threads, plus `optional` ones too if `--include-optional`.
 
+Mark each thread as seen with an 👀 reaction on its first comment (`databaseId` from the query), so
+the bot and a watching human can tell it is being worked. GitHub's reaction set is fixed; `eyes` is
+the only "looking at it" value:
+
+```bash
+gh api --method POST repos/{owner}/{repo}/pulls/comments/<DATABASE_ID>/reactions -f content=eyes
+```
+
 #### C. Check exit conditions
 
 Stop if the working set is empty, or max iterations reached.
@@ -121,6 +129,16 @@ This is the "answer to the comments" half of the job, not optional cleanup, and
   Pass the thread id and reply text as GraphQL **variables** (`-f threadId=... -f body=...`), never interpolated into the query string itself: a reply containing a quote, backtick, or newline breaks (or worse, injects into) a hand-built query. Then resolve with `resolveReviewThread` (see references file).
 - **Blocked** findings: reply explaining exactly why (false positive / needs a human call), but **do not resolve**: leave the thread open. A blocked finding that gets silently resolved is a false "done".
 
+Then record each disposition as a reaction on the thread's first comment: the learning signal, and
+a visible marker for a human scanning the PR. 👍 (`+1`) for a fixed finding, 👎 (`-1`) for a
+blocked/rebutted one. Reply first, react, then resolve: a reaction never replaces the reply.
+
+```bash
+gh api --method POST repos/{owner}/{repo}/pulls/comments/<DATABASE_ID>/reactions -f content=+1
+# blocked/rebutted finding:
+gh api --method POST repos/{owner}/{repo}/pulls/comments/<DATABASE_ID>/reactions -f content=-1
+```
+
 Go back to step A.
 
 ### 3. Report

package/plugins/olko-github-pr/skills/qodoloop/references/graphql-queries.md

@@ -26,7 +26,7 @@ query($cursor: String) {
           id
           isResolved
           comments(first: 1) {
-            nodes { body path line author { login } }
+            nodes { databaseId body path line author { login } }
           }
         }
       }
@@ -60,7 +60,7 @@ while :; do
               nodes {
                 id
                 isResolved
-                comments(first: 1) { nodes { body path line author { login } } }
+                comments(first: 1) { nodes { databaseId body path line author { login } } }
               }
             }
           }
@@ -126,6 +126,23 @@ the branch (SKILL.md §2E-F): resolving first and pushing second means a
 failed push leaves GitHub showing the finding as handled when it isn't. Never
 resolve a blocked/skipped finding at all; reply to it and leave it open.
 
+## React to a comment (the bot's learning signal)
+
+Reacting needs the comment's REST id, which is why `databaseId` is selected in
+the thread query above. The reaction set is fixed; only eight values exist:
+`+1`, `-1`, `laugh`, `confused`, `heart`, `hooray`, `rocket`, `eyes`.
+
+```bash
+# 👀 as soon as you start working a finding
+gh api --method POST repos/{owner}/{repo}/pulls/comments/<DATABASE_ID>/reactions -f content=eyes
+# 👍 when it was accepted and fixed, 👎 when it was rebutted (the correction signal)
+gh api --method POST repos/{owner}/{repo}/pulls/comments/<DATABASE_ID>/reactions -f content=+1
+gh api --method POST repos/{owner}/{repo}/pulls/comments/<DATABASE_ID>/reactions -f content=-1
+```
+
+React after the reply and before the resolve, so GitHub records the reason and
+the disposition together. A reaction never replaces the reply.
+
 ## Fetch the rollup issue comment (context only, not the source of truth)
 
 Useful for the human-readable summary counts (bugs/rule-violations) in your

package/plugins/olko-obsidian/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-obsidian",
   "description": "Keep an Obsidian vault in sync with work: PR sync, task rollover, morning routine.",
-  "version": "1.49.2",
+  "version": "1.51.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-product/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-product",
   "description": "Take a product idea to a shippable build: MVP passes, full-stack scaffolds, UX/UI quality loops, launch plans.",
-  "version": "1.49.2",
+  "version": "1.51.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-reflection/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-reflection",
   "description": "Look back and improve: self-critique, retrospectives, performance review, rapid learning.",
-  "version": "1.49.2",
+  "version": "1.51.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-release/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-release",
   "description": "Ship a release: semantic-release setup, changelogs, store listing copy, release-day routine.",
-  "version": "1.49.2",
+  "version": "1.51.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-skill-meta/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-skill-meta",
   "description": "Author and maintain agent skills and the AI toolchain itself.",
-  "version": "1.49.2",
+  "version": "1.51.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-web-ops/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-web-ops",
   "description": "Operate a website: WAF rules, search console audits, analytics bootstrap, docs indexes.",
-  "version": "1.49.2",
+  "version": "1.51.0",
   "author": {
     "name": "Oleg Koval"
   },

package/scripts/lib/catalog.mjs

@@ -6,7 +6,7 @@ export const PLUGIN_ASSIGNMENT = {
   'olko-github-pr': {
     description: 'Drive GitHub pull requests to merge-ready: review-bot loops, CI fixes, descriptions, dependency triage.',
     skills: ['pr-finalize', 'pr-finalize-complete', 'pr-to-green', 'pr-description-writer',
-             'qodoloop', 'coderabbitloop', 'codexloop', 'geminiloop', 'ci-fix-loop',
+             'qodoloop', 'coderabbitloop', 'codexloop', 'copilotloop', 'geminiloop', 'ci-fix-loop',
              'dependabot-triage', 'lekker-review'],
   },
   'olko-git-tools': {