@olegkoval/agent-skills 1.52.0 → 1.54.0

package/plugins/olko-github-pr/skills/lekker-review/scripts/selftest.mjs

@@ -12,7 +12,7 @@
 // It lifts the real functions out of workflow.js by source extraction rather
 // than importing, because workflow.js is written for the Workflow harness (top
 // level `return`, an injected `args` global) and is not importable as a module.
-import { readFileSync } from 'node:fs'
+import { readFileSync, existsSync } from 'node:fs'
 import { fileURLToPath } from 'node:url'
 import { dirname, join } from 'node:path'
 
@@ -142,11 +142,12 @@ check('a custom house rule is a hard rule',
 
 console.log('\nverification scope: depth controls breadth, never the trust bar')
 const crit = { severity: 'critical' }, imp = { severity: 'important' }, obs = { severity: 'observation' }
-// shouldVerify takes one argument now. Depth used to be able to switch verification
-// off entirely, which meant a scan-depth review shipped unverified Criticals.
-check('shouldVerify takes the finding alone', shouldVerify.length, 1)
-check('critical and important are verified, observation is not',
-  [crit, imp, obs].map(f => shouldVerify(f)), [true, true, false])
+// Depth used to be able to switch verification off entirely, which meant a
+// scan-depth review shipped unverified Criticals. Only `deps` opts out now (its
+// single checklist agent reports advisory facts), see the deps depth section.
+check('critical and important are verified at every non-deps depth, observation is not',
+  ['scan', 'medium', 'deep', undefined].map(d => [crit, imp, obs].map(f => shouldVerify(f, d))),
+  Array(4).fill([true, true, false]))
 check('a hard rule is NOT exempt from verification',
   shouldVerify({ severity: 'critical', rule: 'TS-2', file: 'x.js', badCode: '', description: '', title: '' }), true)
 check('a custom hard rule is NOT exempt either',
@@ -319,5 +320,68 @@ console.log('\ncloser picker: pool, exact rendering, fail-soft and --check')
   check('github-post and artifact-page both use CLOSER', read('references/github-post.md').includes('CLOSER') && read('references/artifact-page.md').includes('CLOSER'), true)
 }
 
+console.log('\ndeps depth: routing, classifier, line validation')
+{
+  const dimsSrc = (() => { try { return lift('dimensionsFor') } catch { return null } })()
+  check('workflow.js defines dimensionsFor', Boolean(dimsSrc), true)
+  if (dimsSrc) {
+    const dimensionsFor = new Function(dimsSrc + '\nreturn dimensionsFor')()
+    const M = { review: 'r', triage: 't' }
+    check('deps runs exactly one agent', dimensionsFor('deps', M).map(d => d.file), ['deps.md'])
+    check('scan still runs the triage pair', dimensionsFor('scan', M).length, 2)
+    check('medium still runs five specialists', dimensionsFor('medium', M).length, 5)
+    check('every dimension prompt file exists',
+      ['deps', 'scan', 'medium'].flatMap(d => dimensionsFor(d, M)).every(d => existsSync(join(SKILL, 'references', 'agents', d.file))), true)
+  }
+  check('deps verifies nothing', [crit, imp, obs].map(f => shouldVerify(f, 'deps')), [false, false, false])
+  check('scan still verifies Criticals and Importants', [crit, imp, obs].map(f => shouldVerify(f, 'scan')), [true, true, false])
+  check('deps skips the prover', /depth !== 'scan' && depth !== 'deps'/.test(src), true)
+
+  const { classify } = await import(join(SKILL, 'scripts', 'deps-only.mjs'))
+  const pkg = o => JSON.stringify(o)
+  const files = {
+    'BASE:web/package.json': pkg({ name: 'web', scripts: { t: 'vitest' }, devDependencies: { vitest: '^3.2.0' }, engines: { node: '>=20' } }),
+    'HEAD:web/package.json': pkg({ name: 'web', scripts: { t: 'vitest' }, devDependencies: { vitest: '^3.2.4' }, overrides: { tinypool: '^2.1.2' }, engines: { node: '>=20' } }),
+    'BASE:eng/package.json': pkg({ name: 'eng', engines: { node: '>=20' } }),
+    'HEAD:eng/package.json': pkg({ name: 'eng', engines: { node: '>=24' } }),
+    'BASE:mix/package.json': pkg({ name: 'mix', scripts: { t: 'jest' }, dependencies: { a: '1' } }),
+    'HEAD:mix/package.json': pkg({ name: 'mix', scripts: { t: 'vitest' }, dependencies: { a: '2' } }),
+  }
+  const readAt = (rev, p) => files[`${rev}:${p}`] ?? null
+  const deps = classify(['package-lock.json', 'web/package.json', 'web/package-lock.json'], readAt)
+  check('lockfiles + dep keys -> deps', deps.kind, 'deps')
+  check('deps reports the changed dep keys', deps.packageJsons[0].depKeysChanged, ['devDependencies', 'overrides'])
+  check('deps reports each lockfile dir', deps.lockDirs, ['.', 'web'])
+  check('engines-only change -> deps', classify(['eng/package.json'], readAt).kind, 'deps')
+  check('a scripts change -> mixed', classify(['mix/package.json', 'package-lock.json'], readAt).kind, 'mixed')
+  check('a source file -> mixed', classify(['package-lock.json', 'web/src/a.ts'], readAt).kind, 'mixed')
+  check('an added package.json -> mixed', classify(['new/package.json'], readAt).kind, 'mixed')
+
+  const { validate, loadDedup } = await import(join(SKILL, 'scripts', 'validate-lines.mjs'))
+  const { mkdtempSync, writeFileSync: wf, mkdirSync } = await import('node:fs')
+  const { tmpdir } = await import('node:os')
+  const wt = mkdtempSync(join(tmpdir(), 'lekker-lines-'))
+  mkdirSync(join(wt, 'web'))
+  const body = Array.from({ length: 80 }, (_, i) => `  "pad${i}": "x",`)
+  body[69] = '    "tinypool": "^2.1.2"'
+  wf(join(wt, 'web', 'package.json'), body.join('\n'))
+  const dedupFn = loadDedup(target)
+  const f = (line, badCode, title = 'tinypool override forces a major') =>
+    ({ file: 'web/package.json', line, severity: 'observation', title, description: '', badCode, fix: '' })
+  const r = validate([
+    f(398, '+    "tinypool": "^2.1.2"'),
+    f(70, '"tinypool": "^2.1.2"', 'tinypool override forces a major vitest does not declare'),
+    f(12, 'something that is not in the file at all', 'phantom'),
+    f(71, '"tinypool": "^2.1.2"', 'near enough'),
+    { file: 'CI: checks / audit', line: 1, severity: 'observation', title: 'ci', description: '', badCode: 'x', fix: '' },
+  ], wt, dedupFn)
+  check('diff line 398 is re-anchored to file line 70, then merged with its twin',
+    r.findings.filter(x => x.line === 70 && /tinypool/.test(x.title)).length, 1)
+  check('an unfindable badCode nulls the line', r.findings.find(x => x.title === 'phantom')?.line, null)
+  check('within +-3 lines is kept', r.findings.some(x => x.line === 71 || x.title === 'near enough'), true)
+  check('a non-file anchor is left alone', r.findings.find(x => x.title === 'ci')?.line, 1)
+  check('summary counts', [r.summary.remapped, r.summary.nulled, r.summary.unchecked], [1, 1, 1])
+}
+
 console.log(failed === 0 ? '\nall checks passed\n' : `\n${failed} check(s) FAILED\n`)
 process.exit(failed === 0 ? 0 : 1)

package/plugins/olko-github-pr/skills/lekker-review/scripts/setup-worktree.sh

@@ -134,7 +134,23 @@ if [[ -n "$LOCAL_REPO" ]]; then
         exit 1
     fi
 else
-    git -C "$REPO_ROOT" fetch origin "$PR_BRANCH" 2>/dev/null || true
+    # Fetch the base branch too: without it origin/<base> is whatever this clone
+    # last saw, and the merge-base drifts back far enough to list files the PR
+    # never touched (65 instead of 9 on one review). Explicit refspecs, because
+    # a --depth clone is single-branch and would not update either ref.
+    # LEKKER_BASE_BRANCH names the branch to fetch when LEKKER_BASE_REF is not
+    # origin/<branch>: a merged PR is diffed against <mergeCommit>^1, because its
+    # head is already inside the base branch and the merge-base would be the head.
+    FETCH_SPECS=("+refs/heads/${PR_BRANCH}:refs/remotes/origin/${PR_BRANCH}")
+    BASE_BRANCH="${LEKKER_BASE_BRANCH:-}"
+    if [[ -z "$BASE_BRANCH" && "${LEKKER_BASE_REF:-}" == origin/* ]]; then
+        BASE_BRANCH="${LEKKER_BASE_REF#origin/}"
+    fi
+    if [[ -n "$BASE_BRANCH" ]]; then
+        FETCH_SPECS+=("+refs/heads/${BASE_BRANCH}:refs/remotes/origin/${BASE_BRANCH}")
+    fi
+    git -C "$REPO_ROOT" fetch origin "${FETCH_SPECS[@]}" 2>/dev/null \
+        || git -C "$REPO_ROOT" fetch origin "$PR_BRANCH" 2>/dev/null || true
 
     if ! git -C "$REPO_ROOT" worktree add "$WORKTREE_PATH" "origin/$PR_BRANCH" 2>/dev/null; then
         if ! git -C "$REPO_ROOT" worktree add "$WORKTREE_PATH" FETCH_HEAD 2>/dev/null; then
@@ -146,19 +162,9 @@ else
 fi
 
 # ---------------------------------------------------------------------------
-# 3. node_modules symlink
-# ---------------------------------------------------------------------------
-NM_LINKED=false
-if [[ -d "$REPO_ROOT/node_modules" ]]; then
-    ln -s "$REPO_ROOT/node_modules" "$WORKTREE_PATH/node_modules"
-    NM_LINKED=true
-else
-    NOTES="${NOTES}no-node_modules-static-checks-skipped;"
-fi
-
-# ---------------------------------------------------------------------------
-# 3b. Determine changed files (to scope tsc/eslint to this PR's diff instead
-#     of the whole repo -- see scripts/changed-files.sh).
+# 3. Determine changed files (to scope tsc/eslint to this PR's diff instead
+#    of the whole repo -- see scripts/changed-files.sh). Runs before the
+#    node_modules step, which needs to know whether a lockfile changed.
 # ---------------------------------------------------------------------------
 CHANGED_FILES_FILE="/tmp/lekker-changed-$$.txt"
 CF_ERR_FILE="$(mktemp "${TMPDIR:-/tmp}/lekker-changed-err.XXXXXX")"
@@ -188,6 +194,100 @@ else
     NOTES="${NOTES}static-checks-repo-wide-no-base-ref;"
 fi
 
+# The caller passes the PR's own file count (gh pr view) so a merge-base that
+# still drifted is reported instead of silently widening the static checks.
+if [[ -n "${LEKKER_EXPECTED_FILES:-}" ]] && [[ -f "$CHANGED_FILES_FILE" ]]; then
+    GOT_FILES="$(grep -c . "$CHANGED_FILES_FILE" 2>/dev/null || true)"
+    if [[ "${GOT_FILES:-0}" != "$LEKKER_EXPECTED_FILES" ]]; then
+        NOTES="${NOTES}changed-files-mismatch:${GOT_FILES:-0}-vs-${LEKKER_EXPECTED_FILES};"
+    fi
+fi
+
+# ---------------------------------------------------------------------------
+# 3b. node_modules
+#     A PR that changes a lockfile gets a fresh `npm ci` in each changed
+#     lockfile's dir: the repo root's node_modules holds the OLD tree, so
+#     symlinking it would type-check and lint against dependencies the PR
+#     replaced. Every other PR symlinks the root's node_modules as before.
+# ---------------------------------------------------------------------------
+NM_LINKED=false
+DEPS_INSTALL_FILE="/tmp/lekker-deps-install-$$.tsv"
+printf '' > "$DEPS_INSTALL_FILE"
+
+LOCK_DIRS=()
+if [[ -s "$CHANGED_FILES_FILE" ]]; then
+    while IFS= read -r cf; do
+        case "$cf" in
+            package-lock.json|npm-shrinkwrap.json) LOCK_DIRS+=(".") ;;
+            */package-lock.json|*/npm-shrinkwrap.json) LOCK_DIRS+=("${cf%/*}") ;;
+            yarn.lock|*/yarn.lock|pnpm-lock.yaml|*/pnpm-lock.yaml|bun.lock|*/bun.lock|bun.lockb|*/bun.lockb)
+                NOTES="${NOTES}deps-install-unsupported:${cf};" ;;
+        esac
+    done < "$CHANGED_FILES_FILE"
+fi
+
+# Portable timeout (macOS has no `timeout`). Exit 143 means it was killed.
+run_with_timeout() {
+    local secs pid watcher rc
+    secs="$1"; shift
+    "$@" &
+    pid=$!
+    ( sleep "$secs"; kill -TERM "$pid" 2>/dev/null ) &
+    watcher=$!
+    rc=0
+    wait "$pid" || rc=$?
+    kill "$watcher" 2>/dev/null || true
+    wait "$watcher" 2>/dev/null || true
+    return "$rc"
+}
+
+ROOT_LOCK_CHANGED=false
+for d in "${LOCK_DIRS[@]+"${LOCK_DIRS[@]}"}"; do
+    [[ "$d" == "." ]] && ROOT_LOCK_CHANGED=true
+done
+
+if [[ ${#LOCK_DIRS[@]} -gt 0 ]] && [[ -n "${LEKKER_NO_INSTALL:-}" ]]; then
+    NOTES="${NOTES}deps-install-disabled;"
+elif [[ ${#LOCK_DIRS[@]} -gt 0 ]]; then
+    for d in "${LOCK_DIRS[@]}"; do
+        log_file="/tmp/lekker-npm-ci-$$-${d//\//_}.log"
+        # --ignore-scripts: a dependency bump under review must not get to run
+        # its postinstall on the reviewer's machine.
+        rc=0
+        (cd "$WORKTREE_PATH/$d" && run_with_timeout 300 npm ci --ignore-scripts \
+            --no-audit --no-fund --prefer-offline) > "$log_file" 2>&1 || rc=$?
+        if [[ "$rc" == "0" ]]; then
+            status="ok"
+            [[ "$d" == "." ]] && NM_LINKED=true
+        elif [[ "$rc" == "143" ]]; then
+            status="timeout"
+        else
+            status="failed"
+        fi
+        printf '%s\t%s\t%s\n' "$d" "$status" "$log_file" >> "$DEPS_INSTALL_FILE"
+        [[ "$status" == "ok" ]] || NOTES="${NOTES}deps-install-${status}:${d};"
+    done
+fi
+
+if [[ "$ROOT_LOCK_CHANGED" == "false" ]]; then
+    if [[ -d "$REPO_ROOT/node_modules" ]]; then
+        ln -s "$REPO_ROOT/node_modules" "$WORKTREE_PATH/node_modules"
+        NM_LINKED=true
+    fi
+fi
+
+# Nested packages (web/, extensions/*) resolve imports from their own
+# node_modules; without it tsc reports every import in them as TS2307.
+while IFS= read -r pj; do
+    d="${pj#"$WORKTREE_PATH"/}"; d="${d%/package.json}"
+    [[ -e "$WORKTREE_PATH/$d/node_modules" ]] && continue
+    [[ -d "$REPO_ROOT/$d/node_modules" ]] || continue
+    case " ${LOCK_DIRS[*]+"${LOCK_DIRS[*]}"} " in *" $d "*) continue ;; esac
+    ln -s "$REPO_ROOT/$d/node_modules" "$WORKTREE_PATH/$d/node_modules"
+done < <(find "$WORKTREE_PATH" -mindepth 2 -maxdepth 3 -name package.json \
+    -not -path '*/node_modules/*' 2>/dev/null)
+[[ "$NM_LINKED" == "true" ]] || NOTES="${NOTES}no-node_modules-static-checks-skipped;"
+
 # Lintable, still-on-disk changed files (a deleted file must not go to eslint).
 ESLINT_TARGETS=()
 if [[ -s "$CHANGED_FILES_FILE" ]]; then
@@ -327,6 +427,7 @@ python3 - \
     "$TSC_CHANGED_FILE" \
     "$TSC_COUNT_FILE" \
     "$MERGE_BASE_VAL" \
+    "$DEPS_INSTALL_FILE" \
     "$OUT_JSON" <<'PYEOF'
 import json, sys, os
 
@@ -334,7 +435,7 @@ import json, sys, os
  tsc_file, eslint_file, rules_file, delta_file, notes,
  changed_files_file, base_ref_val, eslint_scope_file,
  tsc_changed_file, tsc_count_file, merge_base_val,
- out_json) = sys.argv[1:17]
+ deps_install_file, out_json) = sys.argv[1:18]
 
 def read_file(path):
     if not os.path.exists(path):
@@ -342,6 +443,23 @@ def read_file(path):
     with open(path, "r", errors="replace") as f:
         return f.read()
 
+# One row per changed-lockfile dir: dir<TAB>status<TAB>log path. Empty = no
+# lockfile changed (or install disabled), so the root node_modules was linked.
+deps_install = []
+for row in read_file(deps_install_file).splitlines():
+    parts = row.split("\t")
+    if len(parts) != 3:
+        continue
+    d, status, log = parts
+    entry = {"dir": d, "status": status}
+    if status != "ok":
+        entry["tail"] = "\n".join(read_file(log).splitlines()[-20:])
+    deps_install.append(entry)
+    try:
+        os.remove(log)
+    except OSError:
+        pass
+
 changed_files = [l for l in read_file(changed_files_file).splitlines() if l.strip()]
 
 eslint_scope = read_file(eslint_scope_file).strip() or "skipped"
@@ -367,10 +485,12 @@ data = {
     "eslintScope":    eslint_scope,
     "tscChangedTail": read_file(tsc_changed_file),
     "tscErrorCount":  tsc_error_count,
+    "depsInstall":    deps_install,
 }
 
 for p in (tsc_file, eslint_file, rules_file, changed_files_file,
-          eslint_scope_file, tsc_changed_file, tsc_count_file):
+          eslint_scope_file, tsc_changed_file, tsc_count_file,
+          deps_install_file):
     try:
         os.remove(p)
     except OSError:

package/plugins/olko-github-pr/skills/lekker-review/scripts/validate-lines.mjs

@@ -0,0 +1,122 @@
+#!/usr/bin/env node
+// Checks every finding's `line` against the file at HEAD before synthesis.
+// Reviewers sometimes cite a line number of pr.diff instead of the file (a
+// 2026-10-15 finding said package.json:398 for code at line 70), and an
+// inline GitHub comment on the wrong line is worse than none.
+//
+//   node validate-lines.mjs <findings.json> <worktreePath>
+//
+// <findings.json> is an array or { findings: [...] }; it is rewritten in
+// place, same shape. For each finding whose file exists in the worktree:
+//   - badCode's first non-blank line within +-3 of `line` -> kept
+//   - otherwise one unique match in the file -> re-anchored, lineRemapped: true
+//   - no match -> line: null (the finding becomes PR-level, not inline)
+//   - several matches -> kept, lineAmbiguous: true
+// Then dedup (lifted from workflow.js) merges findings that now share an anchor.
+// Prints a one-line JSON summary on stdout.
+import { readFileSync, writeFileSync, existsSync, realpathSync } from 'node:fs'
+import { fileURLToPath } from 'node:url'
+import { dirname, join, resolve, sep } from 'node:path'
+
+const WINDOW = 3
+const SKILL = dirname(dirname(fileURLToPath(import.meta.url)))
+
+function candidates(badCode) {
+  const first = String(badCode || '').split('\n').map(l => l.trim()).find(l => l.length > 0)
+  if (!first) return []
+  // Agents copy from the diff and sometimes keep its "+" marker.
+  const unmarked = first.replace(/^\+\s?/, '').trim()
+  return [...new Set([first, unmarked])].filter(Boolean)
+}
+
+function matches(fileLine, cands) {
+  const t = fileLine.trim()
+  return cands.some(c => t === c || (c.length >= 12 && t.includes(c)))
+}
+
+export function anchor(finding, fileLines) {
+  const cands = candidates(finding.badCode)
+  if (cands.length === 0 || !Number.isInteger(finding.line)) return { finding, outcome: 'unchecked' }
+  const near = []
+  for (let n = Math.max(1, finding.line - WINDOW); n <= Math.min(fileLines.length, finding.line + WINDOW); n++) {
+    if (matches(fileLines[n - 1], cands)) near.push(n)
+  }
+  if (near.length > 0) return { finding, outcome: 'kept' }
+  const hits = []
+  fileLines.forEach((l, i) => { if (matches(l, cands)) hits.push(i + 1) })
+  if (hits.length === 1) {
+    return { finding: { ...finding, line: hits[0], originalLine: finding.line, lineRemapped: true }, outcome: 'remapped' }
+  }
+  if (hits.length === 0) {
+    return { finding: { ...finding, line: null, originalLine: finding.line }, outcome: 'nulled' }
+  }
+  return { finding: { ...finding, lineAmbiguous: true }, outcome: 'ambiguous' }
+}
+
+// Same source-lift selftest.mjs uses: workflow.js runs inside the Workflow
+// harness and cannot be imported, so its dedup is extracted by brace matching.
+export function loadDedup(workflowPath = join(SKILL, 'workflow.js')) {
+  const src = readFileSync(workflowPath, 'utf8')
+  const lift = name => {
+    const i = src.indexOf(`function ${name}`)
+    if (i === -1) throw new Error(`function ${name} not found in workflow.js`)
+    let d = 0, j = i
+    for (;; j++) {
+      if (src[j] === '{') d++
+      else if (src[j] === '}') { d--; if (d === 0) break }
+    }
+    return src.slice(i, j + 1)
+  }
+  const liftConst = (name, fallback) => {
+    const m = new RegExp(`^const ${name} = .*$`, 'm').exec(src)
+    return m ? m[0] : fallback
+  }
+  const preamble = [
+    liftConst('HARD_RULES', 'const HARD_RULES = new Set()'),
+    liftConst('SAME_ISSUE_LINE_WINDOW', 'const SAME_ISSUE_LINE_WINDOW = 30'),
+    liftConst('SEVERITY_RANK', 'const SEVERITY_RANK = { critical: 3, important: 2, observation: 1, idiomatic: 0 }'),
+    ...['titleTokens', 'sameIssue', 'nearbyLines', 'spanWithinWindow',
+        'isHardRule', 'longest', 'mergeFindings', 'dedup'].map(lift),
+  ].join('\n')
+  return new Function(preamble + '\nreturn dedup')()
+}
+
+export function validate(findings, worktree, dedup) {
+  const root = resolve(worktree)
+  const summary = { kept: 0, remapped: 0, nulled: 0, ambiguous: 0, unchecked: 0, merged: 0 }
+  const cache = new Map()
+  const out = findings.map(f => {
+    const path = resolve(root, String(f.file || ''))
+    if (!f.file || !path.startsWith(root + sep) || !existsSync(path)) {
+      summary.unchecked++
+      return f
+    }
+    if (!cache.has(path)) cache.set(path, readFileSync(path, 'utf8').split('\n'))
+    const { finding, outcome } = anchor(f, cache.get(path))
+    summary[outcome]++
+    return finding
+  })
+  // dedup compares line distances, so only anchored findings go through it.
+  const anchored = out.filter(f => Number.isInteger(f.line))
+  const rest = out.filter(f => !Number.isInteger(f.line))
+  const merged = summary.remapped > 0 && dedup ? dedup(anchored) : anchored
+  summary.merged = anchored.length - merged.length
+  return { findings: merged.concat(rest), summary }
+}
+
+function isMain() {
+  try { return realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url)) } catch { return false }
+}
+
+if (isMain()) {
+  const [file, worktree] = process.argv.slice(2)
+  if (!file || !worktree) {
+    console.error('usage: validate-lines.mjs <findings.json> <worktreePath>')
+    process.exit(2)
+  }
+  const raw = JSON.parse(readFileSync(file, 'utf8'))
+  const list = Array.isArray(raw) ? raw : (raw.findings || [])
+  const { findings, summary } = validate(list, worktree, loadDedup())
+  writeFileSync(file, JSON.stringify(Array.isArray(raw) ? findings : { ...raw, findings }, null, 2))
+  console.log(JSON.stringify(summary))
+}

package/plugins/olko-github-pr/skills/lekker-review/workflow.js

@@ -280,13 +280,42 @@ function dedup(allFindings) {
   return result
 }
 
-function shouldVerify(finding) {
-  // Review depth controls breadth, not the trust bar. Every finding that can
-  // affect the verdict must be checked. Hard rules take the verifier's
+function shouldVerify(finding, depth) {
+  // deps: one checklist agent over version bumps. Its findings are advisory
+  // facts (audit delta, install result, override vs declared range), not
+  // runtime-failure claims, so there is nothing for a verifier to refute.
+  if (depth === 'deps') {
+    return false
+  }
+  // Every other depth: review depth controls breadth, not the trust bar. Every finding
+  // that can affect the verdict must be checked. Hard rules take the verifier's
   // rule-specific anchor/applicability path instead of its runtime challenges.
   return finding.severity === 'critical' || finding.severity === 'important'
 }
 
+// Which reviewers run at each depth. `deps` is a PR whose only changes are
+// lockfiles and the dependency keys of package.json: five specialists would
+// produce a couple of notes that a single checklist agent covers, so it gets
+// exactly one.
+function dimensionsFor(depth, MODEL) {
+  if (depth === 'deps') {
+    return [{ key: 'deps', file: 'deps.md', model: MODEL.review }]
+  }
+  if (depth === 'scan') {
+    return [
+      { key: 'triage-quality', file: 'triage-quality.md', model: MODEL.triage },
+      { key: 'triage-logic',   file: 'triage-logic.md',   model: MODEL.triage },
+    ]
+  }
+  return [
+    { key: 'quality',        file: 'quality.md',        model: MODEL.review },
+    { key: 'implementation', file: 'implementation.md', model: MODEL.review },
+    { key: 'simplification', file: 'simplification.md', model: MODEL.review },
+    { key: 'conventions',    file: 'conventions.md',    model: MODEL.review },
+    { key: 'test-quality',   file: 'test-quality.md',   model: MODEL.review },
+  ]
+}
+
 /**
  * Does the finding carry enough of a composed boundary map to attempt a
  * proof? Requires an entry point and a consumer, plus at least one of a
@@ -465,20 +494,8 @@ const budgetAtStart = budget.spent()
   // Dimensions by depth
   // -------------------------------------------------------------------------
 
-  const isScan = depth === 'scan'
-
-  const dimensions = isScan
-    ? [
-        { key: 'triage-quality', file: 'triage-quality.md', model: 'haiku' },
-        { key: 'triage-logic',   file: 'triage-logic.md',   model: 'haiku' },
-      ]
-    : [
-        { key: 'quality',        file: 'quality.md',        model: 'sonnet' },
-        { key: 'implementation', file: 'implementation.md', model: 'sonnet' },
-        { key: 'simplification', file: 'simplification.md', model: 'sonnet' },
-        { key: 'conventions',    file: 'conventions.md',    model: 'sonnet' },
-        { key: 'test-quality',   file: 'test-quality.md',   model: 'sonnet' },
-      ]
+  const MODEL = { review: 'sonnet', triage: 'haiku' }
+  const dimensions = dimensionsFor(depth, MODEL)
 
   const wtDisplay = worktreePath || 'null (scan mode: diff only)'
 
@@ -497,6 +514,9 @@ const budgetAtStart = budget.spent()
         + ` (it is a REQUIRED property, so do not omit it even when there is nothing to report).`
         + ` If you found no issues, return {"findings": []}, never prose, never an empty object,`
         + ` never a "findings" key nested under anything else.`,
+      `LINE NUMBERS: each finding's "line" is the 1-based line in the file at HEAD,`
+        + ` counted from the hunk header (@@ -a,b +c,d @@ starts at line c), never a line`
+        + ` number of DIFF_FILE itself. Quote the code at that line verbatim in "badCode".`,
     ].join(' ')
 
     if (prevSha) {
@@ -555,7 +575,7 @@ const budgetAtStart = budget.spent()
     })
 
     log(`${dim.key}: ${findings.length} findings, ${
-      findings.filter(function(f) { return shouldVerify(f) }).length
+      findings.filter(function(f) { return shouldVerify(f, depth) }).length
     } to verify`)
 
     return {
@@ -577,7 +597,7 @@ const budgetAtStart = budget.spent()
 
   // A model verdict cannot replace the required production boundary map.
   function enforceBoundary(finding) {
-    if (!shouldVerify(finding)) return finding
+    if (!shouldVerify(finding, depth)) return finding
     const boundary = finding.boundary
     const hasText = function(value) {
       return typeof value === 'string' && value.trim().length > 0
@@ -599,10 +619,10 @@ const budgetAtStart = budget.spent()
   async function verifyAll(findings) {
     findings = findings.map(enforceBoundary)
     const inScope = findings.filter(function(f) {
-      return shouldVerify(f)
+      return shouldVerify(f, depth)
     })
     const outOfScope = findings.filter(function(f) {
-      return !shouldVerify(f)
+      return !shouldVerify(f, depth)
     })
 
     if (inScope.length === 0) {
@@ -712,7 +732,7 @@ const budgetAtStart = budget.spent()
   }))
 
   log(`${deduped.length} unique finding(s) after dedup; verifying ${
-    deduped.filter(function(f) { return shouldVerify(f) }).length
+    deduped.filter(function(f) { return shouldVerify(f, depth) }).length
   }`)
 
   phase('Verify')
@@ -850,7 +870,7 @@ const budgetAtStart = budget.spent()
     ].join(' ')
   }
 
-  if (worktreePath && depth !== 'scan') {
+  if (worktreePath && depth !== 'scan' && depth !== 'deps') {
     const proveCandidates = finalFindings.filter(function(f) {
       return shouldProve(f) && !isHardRule(f)
     })

package/plugins/olko-github-pr/skills/nas-actions-migration/SKILL.md

@@ -0,0 +1,84 @@
+---
+name: nas-actions-migration
+description: Migrate GitHub Actions jobs to a repository-scoped NAS runner safely.
+license: MIT
+allowed-tools: Bash, Read, Write, Edit
+compatibility: Codex, Claude Code, Cursor, GitHub Copilot, Windsurf, Kiro, and other Agent Skills compatible tools. Requires authenticated GitHub CLI, repository access, and NAS runner administration.
+metadata:
+  targets: [_source-only]
+  author: Oleg Koval
+  tags:
+    - github-actions
+    - self-hosted-runner
+    - nas
+    - ci
+    - deployment
+    - migration
+---
+
+# NAS Actions Migration
+
+Migrate eligible GitHub Actions jobs from hosted runners to a dedicated, repository-scoped NAS runner, following the proven Roazon and Funda Radar pattern. This workflow prepares repository changes and documents runner provisioning; it does not claim migration complete until jobs actually execute on the named NAS runner. Never put deployment credentials on a persistent self-hosted runner unless the user explicitly approves that trust boundary.
+
+## When to Use
+
+Use when asked to move Actions/CI jobs to a NAS, copy the Roazon/Funda Radar runner setup, or establish a repeatable NAS migration for another repository.
+
+## Prerequisites
+
+- Authenticated `gh` with access to the target repo and its Actions settings.
+- SSH/admin access to the NAS and an approved secret manager for durable runner credentials.
+- Read repository instructions and the target workflows before changing them.
+- Inspect existing comparable repos; treat runner names, labels, commands, and service-specific workflow behavior as examples, not copy-ready values.
+
+## Procedure
+
+1. **Inventory the target.** Record every workflow, job, `runs-on`, trigger, fork behavior, required secrets, runtime/dependency setup, timeouts, deploy side effects, and current status. Determine the repository default branch and ensure the checkout is clean. Check existing repository runners and variables:
+
+   ```sh
+   gh api repos/OWNER/REPO/actions/runners --jq '.runners[] | {name,status,labels:[.labels[].name]}'
+   gh variable list --repo OWNER/REPO
+   ```
+
+2. **Inspect a known-good migration.** Compare the requested repository with the live `roazon` and `funda-radar` workflows and runner docs. Use a unique runner label for the target repo: repository-scoped runners cannot be shared across repositories. Never assume a label, runner container, or variable is already present.
+
+3. **Classify jobs.** Move builds/tests/lint and other trusted, non-secret CI work first. Keep deploy jobs on hosted runners by default so deploy credentials never reach the NAS. Move additional jobs only after assessing credential exposure, untrusted code paths, network/data access, persistence, and resource requirements. Preserve existing required checks and non-blocking semantics.
+
+4. **Route through an explicit opt-in variable.** Use a repository variable such as `CI_RUNNER=nas`, with a hosted-runner fallback until activation:
+
+   ```yaml
+   runs-on: ${{ vars.CI_RUNNER == 'nas' && fromJSON('["self-hosted","linux","REPO-nas"]') || 'ubuntu-latest' }}
+   ```
+
+   For every job that can execute repository-controlled code on the NAS, add a fork guard:
+
+   ```yaml
+   if: >-
+     github.event_name != 'pull_request'
+     || github.event.pull_request.head.repo.full_name == github.repository
+   ```
+
+   Guard each job independently. Never rely on a downstream job's guard to protect an unguarded dependency. Add exact toolchain setup because runner images may not contain Node, Bun, browsers, Docker, or compatible system libraries.
+
+5. **Document provisioning and rollback.** Provide the target repo's exact runner name, label, container/image, dedicated work directory, ephemeral/restart settings, required tool installation, safe secret storage, and health check. For persistent runners, use a narrowly scoped fine-grained PAT with repository Administration read/write in the NAS secret store; pass it as `ACCESS_TOKEN` only via a root-readable env file. Do not print, commit, message, or substitute a short-lived registration token for a restart-persistent credential. Never reuse another repo's `/_work` or token.
+
+   Document rollback as deleting the opt-in variable, which routes eligible jobs back to `ubuntu-latest`. State that this fallback still depends on GitHub Actions billing being available.
+
+6. **Provision before activation.** Confirm the target repository runner is online and has `self-hosted`, `Linux`, and the exact repo label. If there is no approved NAS access/token, stop before registration and leave the variable unset. Never create a fake runner or assume an online runner in another repo is usable.
+
+7. **Activate and exercise the real path.** Set the repository variable only after runner readiness. Dispatch each affected workflow on a trusted branch, then inspect run/job details and confirm every moved job reports the intended `runner_name`, expected runner labels, and passes. A green result on `ubuntu-latest`, a skipped job, or a successful deployment-provider status does not verify NAS execution.
+
+8. **Recheck safety and report.** Review the final diff, validate workflow syntax, run any local lint/tests available, and inspect for unsafe fork access, missing setup, accidental secret exposure, and unintended deploy changes. Report changed workflows, moved and intentionally unmoved jobs, runner readiness, verification run URLs and runner names, rollback command, and blockers. Do not say “migrated” while registration or NAS execution remains unverified.
+
+## Pitfalls
+
+- GitHub repository runners are scoped to their repository unless deliberately configured as organization runners; the Roazon and Funda runners do not automatically serve a third repo.
+- `CI_RUNNER=nas` is opt-in routing, not runner provisioning. Setting it before registration leaves jobs queued or failed.
+- Self-hosted runners execute untrusted code with the runner host's access. Fork guards are mandatory, and persistent workspaces must be isolated.
+- The current runner container may lack a runtime or compatible glibc. Test project-specific integration jobs on the exact image before declaring success.
+- A billing-blocked hosted fallback cannot rescue a failed/offline NAS runner.
+- Do not migrate deploy credentials or mutate production service settings as incidental cleanup.
+
+## Verification
+
+Migration is complete only when (a) the target runner is online with the expected repo-specific label, (b) every intended job's run metadata names that runner, (c) the required jobs pass on a trusted ref, (d) fork-origin jobs are skipped before reaching NAS, and (e) rollback to hosted routing is documented and can be applied. Otherwise report **prepared, not activated/verified** with the exact missing prerequisite.