@olegkoval/agent-skills 1.66.0 → 1.68.0

package/adapters/claude/olko-github-pr/skills/lekker-review/SKILL.md

@@ -285,23 +285,49 @@ Then:
 `LOCAL_BRANCH` is `main`, `master`, `develop`, `staging`, or `production`, stop
 and say so.
 
-**Depth:** explicit keyword `scan`, `medium`, `deep` or `deps` wins. If absent,
-get the per-file stat - in `pr` mode from
-`gh pr view <PR_NUMBER> --repo <REPO_SLUG> --json additions,deletions,changedFiles,files,baseRefName,state,mergeCommit`
-(keep `baseRefName` as `BASE_BRANCH` and `changedFiles` as `EXPECTED_FILES` for
-Track A; when `state` is `MERGED`, keep `mergeCommit.oid` as `MERGE_COMMIT`), in `branch` mode from `git diff --numstat <MERGE_BASE> HEAD` - and
-apply AUTO-DEPTH. Lockfiles (`package-lock.json`, `npm-shrinkwrap.json`,
-`yarn.lock`, `pnpm-lock.yaml`, `bun.lock`, `bun.lockb`) do NOT count toward
-additions+deletions: a regenerated lockfile is thousands of lines nobody reads.
-- `deps` (candidate) if every changed file is a lockfile or a `package.json`.
-  Confirmed after Track A by `scripts/deps-only.mjs` (see "Confirm deps depth");
-  until then run Track B as for `scan`.
-- `scan` if additions+deletions < 150 AND changedFiles <= 5
-- `deep` if additions+deletions > 800 OR changedFiles > 25 OR diff touches
-  `migrations/` or `*.sql`
-- `medium` otherwise
-
-State the chosen depth (and whether it was auto-selected) in the review header.
+**Depth:** record an explicit `scan`, `medium`, `deep` or `deps` request;
+otherwise select a provisional depth from the per-file stats. In `pr` mode use
+`gh pr view <PR_NUMBER> --repo <REPO_SLUG> --json additions,deletions,changedFiles,files,baseRefName,state,mergeCommit`.
+Keep `baseRefName` as `BASE_BRANCH`, `changedFiles` as `EXPECTED_FILES`, and
+`mergeCommit.oid` as `MERGE_COMMIT` when merged. In `branch` mode use
+`git diff --numstat <MERGE_BASE> HEAD`.
+
+**Mandatory risk check (every depth, including explicit requests):** after
+Track B has saved `pr.diff`, and before finalizing depth or starting Step 2,
+run `scripts/risk-paths.mjs` with that diff and the exact changed paths.
+Resolve the script beside the selected `SKILL.md`: in Codex use
+`<directory containing selected SKILL.md>/scripts/risk-paths.mjs`; in Claude
+use `${CLAUDE_PLUGIN_ROOT}/skills/lekker-review/scripts/risk-paths.mjs`.
+Use a shell-free process API with separate arguments:
+`execFileSync('node', [riskScript, '--diff', diffFile, '--', ...changedPaths])`.
+Never interpolate PR-controlled paths into shell source. Alternatively pipe
+`git diff --name-only -z <MERGE_BASE> HEAD` into
+`node "<resolved riskScript>" --stdin0 --diff "<scratchpad>/pr.diff"`.
+Do not continue on classifier failure; report risk classification unavailable.
+
+The classifier detects configured path patterns for CI workflows, auth,
+billing, installers/setup, and P21, plus `p21` in added lines. These are path
+heuristics, not complete detection of auth/billing behavior in generic files;
+reviewers still inspect that behavior in the diff. Whenever
+`needsHumanReview: true`, always put `NEEDS HUMAN REVIEW: <categories>` in the
+review header, even for an explicit scan. A human must read those paths.
+
+Explicit depth wins, but never suppresses this marker. Without an explicit
+request, apply AUTO-DEPTH in this order after the risk check:
+- `deep` if the classifier returns `deep: true`, additions+deletions > 800,
+  changedFiles > 25, or the diff touches `migrations/` or `*.sql`.
+- `deps` (candidate) if every changed file is a lockfile or `package.json`.
+  Confirm after Track A with `scripts/deps-only.mjs`; until then run Track B
+  as for `scan`.
+- `scan` if additions+deletions < 150 AND changedFiles <= 5.
+- `medium` otherwise.
+
+Lockfiles (`package-lock.json`, `npm-shrinkwrap.json`, `yarn.lock`,
+`pnpm-lock.yaml`, `bun.lock`, `bun.lockb`) do not count toward additions+deletions.
+Step 0 depth is provisional: if the mandatory check upgrades scan, run Track A
+and gather the newly required Track B sources before Step 2. Branch mode uses
+Track A's merge-base diff. State final depth and whether auto-selected in the
+review header.
 
 **`--post` flag:** parse and store as `POST_REVIEW=true`.
 
@@ -673,7 +699,7 @@ Write `<scratchpad>/context.json` with keys:
   "botPatternsFile": "<BOT_PATTERNS_FILE, or null>",
   "depsReport":      "<deps-report.json contents at depth deps, else null>",
   "depsInstall":     "<worktree.json depsInstall>",
-  "prBody":          "<PR body at depth deps, else omit>"
+  "prBody":          "<full PR body at every depth; empty string in branch mode>"
 }
 ```
 
@@ -1113,8 +1139,17 @@ printf '%s\n' "$REVIEW_FILE" > ~/.cache/lekker-review/reviewed/<headSha>
 ```
 
 Write it against the sha that was actually reviewed. When fix mode later adds
-commits, write a marker for the NEW head sha too - a gate keys on the tip
-that is about to be pushed, and a marker for a superseded sha would be a lie.
+commits, write a marker for the new head only after fix verification and
+relevant tests pass. Any unrelated edits require a fresh review; never copy a
+marker to an unreviewed SHA.
+
+**PR label for branch reviews:** follow `references/reviewed-before-push.md`.
+After a complete, non-degraded local review and settling all Critical/Important
+findings, save the final-head receipt as `<scratchpad>/pre-push-review.json`
+BEFORE pushing. That reference defines the receipt schema and one-time cleanup
+workflow setup. The label is exactly `reviewed-before-push` (no AI prefix).
+A legacy SHA/path marker alone does not qualify. PR-mode reviews cannot earn
+this label.
 
 **Close the run log** right after the receipt, then print the review:
 
@@ -1288,33 +1323,42 @@ Ask once, via AskUserQuestion:
 
 Rules for each answer:
 
-- **Yes:** push with `git push -u origin "$local_branch"`, then create the PR
+- **Yes:** set `PREDICTED_AT=$(date -u +%Y-%m-%dT%H:%M:%SZ)` before pushing
+  or publishing, including when a PR already exists. Then push with
+  `git push -u origin "$local_branch"` and create or locate the PR. Create it
   with `gh pr create --repo "$repo_slug" --base "$base_ref" --head
   "$local_branch" --title "$pr_title" --body-file "$pr_body_file"`. Derive the title
   from the commit log (the recommended prefix plus a summary of the change) and
   the body from a short summary of what the branch does - do not leave either
-  as a placeholder. Report the PR url. Then record the prediction against the
-  new PR number - a branch-mode review is the ideal case for this, because the
-  prediction provably predates every bot comment. Record only the findings fix
+  as a placeholder. Report the PR url. If an eligible pre-push receipt was
+  saved, publish it using `scripts/review-label.mjs` as described in
+  `references/reviewed-before-push.md`. This posts the commit/engine/depth/result
+  evidence and applies `reviewed-before-push` only to the matching live head.
+  If cleanup is not installed, omit the label and report the setup requirement;
+  do not undo the successful PR creation. For an existing PR found after a
+  branch-mode push, use the same helper and head check. Then record the prediction
+  against the created or existing PR number using the saved `PREDICTED_AT`;
+  scoring uses it to include bot comments triggered by the push or PR creation,
+  even if they arrive before the record step. Record only the findings fix
   mode did NOT apply (every row of the fixes table that is not `✅ applied`):
   an applied fix is gone from the code the bots read, so they cannot raise it,
   and recording it would sink precision for doing exactly what branch mode is
   for. Build `<scratchpad>/unfixed.json` (a bare array is fine) from the merged
   `findings.json` minus the findings fix mode applied; when fix mode did not
-  run or applied nothing, it is the whole merged set. Take
-  `PREDICTED_AT=$(date -u +%Y-%m-%dT%H:%M:%SZ)` just BEFORE `gh pr create`, so
-  a bot comment that lands before the record step still counts:
+  run or applied nothing, it is the whole merged set. Keep the timestamp captured
+  before the push; do not replace it at the record step:
 
   ```bash
   node ${SKILL_ROOT}/scripts/bot-precision.mjs record \
-    --repo "$repo_slug" --pr <NEW_PR_NUMBER> --predicted <scratchpad>/unfixed.json \
+    --repo "$repo_slug" --pr <PR_NUMBER> --predicted <scratchpad>/unfixed.json \
     --at "$PREDICTED_AT"
   ```
 
   The review is already saved locally; offer `--post` on the new PR number only if the user asks - findings that fix
   mode already applied must never be posted as review comments.
 - **Push only:** `git push -u origin "$local_branch"` and stop. Say in one line
-  that no PR was created.
+  that no PR was created. Keep any eligible pre-push receipt for publication
+  when a matching PR is later created; no PR means no label yet.
 - **No:** stop. Print the branch name and the review file path.
 
 **Unattended runs never ask and never create a PR** (see the operating contract

package/adapters/claude/olko-github-pr/skills/lekker-review/references/agents/implementation.md

@@ -48,6 +48,22 @@ Axes to cover:
   fixed, the mitigation fully resolves the defect, or the PR is not a bug fix.
 - Integration Contracts: Shopify API misuse, BC API assumptions, webhook
   idempotency, external API pagination not handled.
+- Rollout safety (external writes): when the diff changes what is WRITTEN to
+  another system (an API payload, field mapping, or a DB write into a system
+  this service does not own), state whether the PR has a feature flag
+  (Reflag / `getShopFlag` / `isEnabled` style check around the new write) or a
+  documented revert plan (PR body or code comment). Look in the diff and in the
+  PR body in CONTEXT_FILE. When WORKTREE_PATH is available, trace the changed
+  write through unchanged callers and flag guards before deciding either is
+  absent. Without a worktree, absence from the diff is not proof: report a
+  missing rollout control only when the diff demonstrates that the changed
+  write bypasses a guard and the PR body provides no revert plan. Otherwise
+  mark rollout verification unavailable rather than inventing a finding.
+  If neither control exists on that evidence, report an `important` finding:
+  `title` starts "No flag or revert plan for external write", `badCode` quotes
+  the changed write, `fix` names the flag guard to add. A pure UI/copy change or
+  a write that is trivially undone by deploying again is exempt. Quiet when the
+  flag or plan is present; do not report its presence.
 
 Boundary contract and lifecycle map (required for every Critical/Important
 finding involving routing, persistence, caching, fallback, proxying, or an

package/adapters/claude/olko-github-pr/skills/lekker-review/references/agents/triage-logic.md

@@ -11,6 +11,22 @@ Axes to cover (Critical/Important only):
 - Scalability: N+1 queries, missing pagination, unbounded collections, missing rate-limit
 - Integration Contracts: Shopify API misuse, webhook idempotency not handled
 - Correctness: off-by-one, wrong operator, missing null guard
+- Rollout safety (external writes): when the diff changes what is WRITTEN to
+  another system (an API payload, field mapping, or a DB write into a system
+  this service does not own), state whether the PR has a feature flag
+  (Reflag / `getShopFlag` / `isEnabled` style check around the new write) or a
+  documented revert plan (PR body or code comment). Look in the diff and in the
+  PR body in CONTEXT_FILE. When WORKTREE_PATH is available, trace the changed
+  write through unchanged callers and flag guards before deciding either is
+  absent. Without a worktree, absence from the diff is not proof: report a
+  missing rollout control only when the diff demonstrates that the changed
+  write bypasses a guard and the PR body provides no revert plan. Otherwise
+  mark rollout verification unavailable rather than inventing a finding.
+  If neither control exists on that evidence, report an `important` finding:
+  `title` starts "No flag or revert plan for external write", `badCode` quotes
+  the changed write, `fix` names the flag guard to add. A pure UI/copy change or
+  a write that is trivially undone by deploying again is exempt. Quiet when the
+  flag or plan is present; do not report its presence.
 
 CI_STATUS: read key "ciStatus" from the JSON file CONTEXT_FILE.
 EXISTING_REVIEWS: read key "existingReviews" from CONTEXT_FILE (awareness only, skip findings at same file:line)

package/adapters/claude/olko-github-pr/skills/lekker-review/references/output-format.md

@@ -24,6 +24,7 @@ Output the review as a markdown response (not via printf). No ANSI escapes.
 **Proofs:** <M proven / N attempted> *(include only when N > 0)*
 **CI:** <✅ All passing | ⚠️ N failing: check-name | ⏳ Pending | N/A>
 **Depth:** <📦 deps | ⚡ scan | 🔍 medium | 🔬 deep>
+**NEEDS HUMAN REVIEW:** <categories from risk-paths.mjs> *(only when `needsHumanReview` is true: a person must read these paths whatever the verdict)*
 **Engine:** <workflow | codex | revmux>
 
 ---

package/adapters/claude/olko-github-pr/skills/lekker-review/references/reviewed-before-push.md

@@ -0,0 +1,94 @@
+# Reviewed before push
+
+`reviewed-before-push` records a completed local branch review of the current
+PR head. It is informational: it does not satisfy CI, required remote review,
+or the human-review marker for risky changes. The review comment records the
+full head/base SHAs, engine, depth, timestamp, and result. It is an attestation
+by the publishing user, not cryptographic proof that review preceded a push.
+
+## Install stale-label cleanup once per repository
+
+Copy `references/reviewed-before-push.yml` into the target repository as
+`.github/workflows/reviewed-before-push.yml` and land it on the default branch
+through that repository's normal review process. Do this before the local
+review whose receipt will be published. Do not add a workflow commit after
+review and then label that unreviewed commit.
+
+The workflow uses only GitHub API data, with no PR checkout. On new commits or
+receipt edits/deletion it removes the label unless a receipt from an owner,
+member, or collaborator matches the live head. Pagination includes all receipt
+comments. It does not add labels or replace merge gates. A newly reviewed head
+can be labeled again by the publisher. Cleanup is asynchronous; the label is
+not a merge-authorization signal. Workflows disabled by repository policy or
+Actions outages can delay removal.
+
+The helper refuses to publish if the cleanup workflow is absent. If setup is
+missing, keep the local review and PR creation successful, omit the label, and
+report the missing setup. Never silently install a write-capable workflow in
+another repository. A push-only run keeps the receipt locally until a PR exists.
+
+## Record before pushing
+
+Only in `MODE=branch`, after the review engine completed without degraded or
+missing required dimensions, settle every Critical/Important finding. Either
+fix it with verifier/test evidence or explicitly rebut it with a reason. Open
+observations may remain. A file containing only a review path or a SHA marker
+is not sufficient evidence.
+
+Save `<scratchpad>/pre-push-review.json` before the push:
+
+```json
+{
+  "version": 1,
+  "mode": "branch",
+  "result": "passed",
+  "headSha": "<full reviewed final local HEAD>",
+  "baseSha": "<full merge-base used by this review>",
+  "engine": "codex",
+  "depth": "medium",
+  "reviewedAt": "<UTC ISO timestamp when this review completed>",
+  "findings": [
+    {
+      "severity": "important",
+      "disposition": "fixed",
+      "evidence": "<actual fix verification and relevant test result>"
+    }
+  ]
+}
+```
+
+Use an empty `findings` array when the review found nothing. Otherwise include
+every finding in the merged review and lint set. Allowed dispositions are
+`fixed`, `rebutted`, and `open`; `open` is permitted only for observations and
+idiomatic suggestions. Rebuttals require specific evidence too. Set engine and
+depth to the values actually used. Keep the saved full review locally; finding
+text, evidence text, and local paths are not uploaded by the helper.
+
+`reviewedAt` must be a valid UTC ISO timestamp in `YYYY-MM-DDTHH:mm:ssZ`
+format, optionally with fractional seconds before `Z` (for example,
+`2026-10-29T09:00:00.123Z`). Date-only strings, timezone offsets, and invalid
+calendar dates are rejected by the publisher and cleanup workflow.
+
+After fixes, the receipt must describe the final SHA: fix verification and
+relevant tests must pass, and the only intervening edits must be those verified
+fixes. Any unrelated edit requires a fresh review. Never copy a receipt to a
+new SHA just to make the label apply.
+
+## Publish after pushing and creating or locating the PR
+
+Resolve the helper relative to the selected `SKILL.md` (same directory's
+`scripts/review-label.mjs`, including in Codex). Invoke with separate process
+arguments, or independently shell-quote each value:
+
+```bash
+node "<SKILL_ROOT>/scripts/review-label.mjs" \
+  --repo "<owner/repo>" --pr "<number>" \
+  --receipt "<scratchpad>/pre-push-review.json"
+```
+
+The helper checks the live open PR head, posts the receipt, creates the label
+if needed, and applies it. It checks the head before and after labeling, and
+removes the label if a concurrent push changed the head. Errors are failures
+to publish the label, not a failed local review. Do not claim the label was
+applied when the helper failed. Do not use this helper for a review performed
+in `MODE=pr` after pushing.

package/adapters/claude/olko-github-pr/skills/lekker-review/references/reviewed-before-push.yml

@@ -0,0 +1,57 @@
+# Install this file on the target repository's default branch as
+# .github/workflows/reviewed-before-push.yml before publishing review labels.
+name: Reviewed before push
+on:
+  pull_request_target:
+    types: [opened, reopened, synchronize, edited, labeled]
+  issue_comment:
+    types: [created, edited, deleted]
+permissions:
+  contents: read
+  issues: write
+  pull-requests: read
+concurrency:
+  group: reviewed-before-push-${{ github.event.pull_request.number || github.event.issue.number }}
+  cancel-in-progress: false
+jobs:
+  reconcile:
+    if: github.event.pull_request || github.event.issue.pull_request
+    runs-on: ubuntu-latest
+    steps:
+      # No checkout: never execute code from the PR with this write token.
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const label = 'reviewed-before-push';
+            function isUtcTimestamp(value) {
+              const match = typeof value === 'string' && value.match(/^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2})(?:\.(\d+))?Z$/);
+              if (!match || match[0] !== value) return false;
+              const time = Date.parse(value);
+              const canonical = `${match[1]}.${(match[2] || '').padEnd(3, '0').slice(0, 3)}Z`;
+              return Number.isFinite(time) && new Date(time).toISOString() === canonical;
+            }
+            const { owner, repo } = context.repo;
+            const issue_number = context.payload.pull_request?.number || context.payload.issue.number;
+            const { data: pr } = await github.rest.pulls.get({ owner, repo, pull_number: issue_number });
+            if (!pr.labels.some(item => item.name === label)) return;
+            const comments = await github.paginate(github.rest.issues.listComments, { owner, repo, issue_number, per_page: 100 });
+            const valid = comments.some(comment => {
+              if (!['OWNER', 'MEMBER', 'COLLABORATOR'].includes(comment.author_association)) return false;
+              const match = comment.body?.match(/<!-- lekker:reviewed-before-push (\{[^\n]*\}) -->/);
+              if (!match) return false;
+              try {
+                const r = JSON.parse(match[1]);
+                return r.version === 1 && r.mode === 'branch' && r.result === 'passed'
+                  && r.headSha === pr.head.sha && /^[a-f0-9]{40}$/.test(r.baseSha)
+                  && ['workflow', 'codex', 'revmux'].includes(r.engine)
+                  && ['scan', 'medium', 'deep', 'deps'].includes(r.depth)
+                  && isUtcTimestamp(r.reviewedAt);
+              } catch { return false; }
+            });
+            if (!valid) {
+              try {
+                await github.rest.issues.removeLabel({ owner, repo, issue_number, name: label });
+              } catch (error) {
+                if (error.status !== 404) throw error;
+              }
+            }

package/adapters/claude/olko-github-pr/skills/lekker-review/scripts/review-label.mjs

@@ -0,0 +1,90 @@
+#!/usr/bin/env node
+// Publish a local branch-review receipt using gh; PR-controlled values never enter shell source.
+import { execFileSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+
+export const LABEL = 'reviewed-before-push';
+export const PREFIX = '<!-- lekker:reviewed-before-push ';
+const SHA = /^[a-f0-9]{40}$/;
+
+function isUtcTimestamp(value) {
+  const match = typeof value === 'string' && value.match(/^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2})(?:\.(\d+))?Z$/);
+  if (!match || match[0] !== value) return false;
+  const time = Date.parse(value);
+  const canonical = `${match[1]}.${(match[2] || '').padEnd(3, '0').slice(0, 3)}Z`;
+  return Number.isFinite(time) && new Date(time).toISOString() === canonical;
+}
+
+export function validateReceipt(receipt) {
+  if (receipt?.version !== 1 || receipt.mode !== 'branch' || receipt.result !== 'passed'
+      || !SHA.test(receipt.headSha) || !SHA.test(receipt.baseSha)
+      || !['workflow', 'codex', 'revmux'].includes(receipt.engine)
+      || !['scan', 'medium', 'deep', 'deps'].includes(receipt.depth)
+      || !isUtcTimestamp(receipt.reviewedAt)
+      || !Array.isArray(receipt.findings)) {
+    throw new Error('Invalid branch-review receipt');
+  }
+  for (const finding of receipt.findings) {
+    if (!['critical', 'important', 'observation', 'idiomatic'].includes(finding.severity)
+        || !['fixed', 'rebutted', 'open'].includes(finding.disposition)
+        || (['critical', 'important'].includes(finding.severity) && finding.disposition === 'open')
+        || (['fixed', 'rebutted'].includes(finding.disposition) && !finding.evidence?.trim())) {
+      throw new Error('Findings require dispositions and evidence; no open Critical/Important finding is allowed');
+    }
+  }
+  return receipt;
+}
+
+export function reviewComment(receipt) {
+  validateReceipt(receipt);
+  // Only publish the attestation, not local paths or potentially sensitive finding text.
+  const { version, mode, result, headSha, baseSha, engine, depth, reviewedAt } = receipt;
+  const attestation = { version, mode, result, headSha, baseSha, engine, depth, reviewedAt };
+  return `Reviewed before push\n\nCommit: \`${headSha}\`\nBase: \`${baseSha}\`\nEngine: ${engine}\nDepth: ${depth}\nReviewed at: ${reviewedAt}\nResult: passed; no unresolved Critical/Important findings.\n\nThis records a local review; required CI and remote review gates still apply.\n\n${PREFIX}${JSON.stringify(attestation)} -->`;
+}
+
+export function publishReview({ repo, pr, receipt }, run = execFileSync) {
+  if (!/^[\w.-]+\/[\w.-]+$/.test(repo) || !/^[1-9]\d*$/.test(String(pr))) {
+    throw new Error('Expected --repo owner/repo and a positive --pr number');
+  }
+  const body = reviewComment(receipt);
+  const gh = (args, input) => run('gh', args, { encoding: 'utf8', input });
+  const readHead = () => JSON.parse(gh(['pr', 'view', String(pr), '--repo', repo, '--json', 'headRefOid,state']));
+  const ensureCurrent = () => {
+    const current = readHead();
+    if (current.state !== 'OPEN' || current.headRefOid !== receipt.headSha) {
+      throw new Error('PR is closed or its head differs from the reviewed commit; label withheld');
+    }
+  };
+  ensureCurrent();
+  // The installation is explicit: do not silently add a privileged workflow to someone else's repo.
+  gh(['api', `repos/${repo}/contents/.github/workflows/reviewed-before-push.yml`]);
+  gh(['api', '--method', 'POST', `repos/${repo}/issues/${pr}/comments`, '--input', '-'], JSON.stringify({ body }));
+  gh(['label', 'create', LABEL, '--repo', repo, '--color', '0E8A16', '--description', 'Local review completed for the current PR head before push', '--force']);
+  ensureCurrent();
+  gh(['pr', 'edit', String(pr), '--repo', repo, '--add-label', LABEL]);
+  // Catch a concurrent push after adding the label. The workflow also reconciles later pushes.
+  try {
+    ensureCurrent();
+  } catch (error) {
+    gh(['pr', 'edit', String(pr), '--repo', repo, '--remove-label', LABEL]);
+    throw error;
+  }
+  return { label: LABEL, headSha: receipt.headSha };
+}
+
+function main(argv) {
+  const options = {};
+  for (let i = 0; i < argv.length; i += 2) {
+    if (!['--repo', '--pr', '--receipt'].includes(argv[i]) || !argv[i + 1] || options[argv[i]]) {
+      throw new Error('Usage: review-label.mjs --repo owner/repo --pr N --receipt receipt.json');
+    }
+    options[argv[i]] = argv[i + 1];
+  }
+  if (!options['--receipt']) throw new Error('--receipt is required');
+  const receipt = JSON.parse(readFileSync(options['--receipt'], 'utf8'));
+  console.log(JSON.stringify(publishReview({ repo: options['--repo'], pr: options['--pr'], receipt })));
+}
+
+if (process.argv[1] === fileURLToPath(import.meta.url)) main(process.argv.slice(2));

package/adapters/claude/olko-github-pr/skills/lekker-review/scripts/risk-paths.mjs

@@ -0,0 +1,67 @@
+#!/usr/bin/env node
+// Path-based risk for AUTO-DEPTH. Size alone misses the small PRs that matter:
+// a 10-line change to a workflow file, a session check or a P21 mapping.
+//
+// Usage:
+//   node risk-paths.mjs [--diff <pr.diff>] -- <changed-file>...
+//   git diff --name-only -z <base>...HEAD | node risk-paths.mjs --stdin0 --diff <pr.diff>
+// Use a shell-free process API for file arguments; never interpolate PR paths.
+//
+// Prints {"deep": bool, "needsHumanReview": bool, "categories": [{category, files}]}.
+// `--diff` also lets the identifier `p21` count when it only appears in added lines.
+
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+
+export const RISK_RULES = [
+  { category: 'ci-workflow', test: (f) => /^\.github\/workflows\//.test(f) },
+  { category: 'auth', test: (f) => /(^|[/._-])(auth|authn|authz|authenticate|authenticated|authentication|authorize|authorized|authorization|oauth|session|sessions|permission|permissions|rbac|acl|jwt|login)([/._-]|$)/i.test(f.replace(/([a-z0-9])([A-Z])/g, '$1-$2')) },
+  { category: 'billing', test: (f) => /(billing|payment|payments|invoice|invoices|checkout|stripe|subscription)/i.test(f) },
+  { category: 'installer', test: (f) => /(^|\/)(install|setup|bootstrap|preinstall|postinstall)(?:[^/.]*|[^/]*\.(sh|bash|zsh|ps1|js|mjs|cjs|ts|py|bat|cmd))$/i.test(f) },
+  { category: 'p21', test: (f) => /p21/i.test(f) },
+];
+
+export function addedLinesMention(diffText, pattern) {
+  return diffText.split('\n').some((l) => l.startsWith('+') && !l.startsWith('+++') && pattern.test(l));
+}
+
+export function riskPaths(files, diffText = '') {
+  const categories = RISK_RULES
+    .map((rule) => ({ category: rule.category, files: files.filter(rule.test) }))
+    .map((c) => (c.category === 'p21' && c.files.length === 0 && addedLinesMention(diffText, /p21/i)
+      ? { ...c, files: ['(identifier p21 in added lines)'] }
+      : c))
+    .filter((c) => c.files.length > 0);
+  return { deep: categories.length > 0, needsHumanReview: categories.length > 0, categories };
+}
+
+function main(argv) {
+  let diffText = '';
+  let inputMode = null;
+  const files = [];
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === '--') {
+      files.push(...argv.slice(i + 1));
+      break;
+    }
+    if (arg === '--diff') {
+      if (!argv[i + 1] || argv[i + 1] === '--') throw new Error('--diff requires a file');
+      diffText = readFileSync(argv[++i], 'utf8');
+    } else if (arg === '--stdin' || arg === '--stdin0') {
+      if (inputMode) throw new Error('Choose only one stdin mode');
+      inputMode = arg;
+    } else if (arg.startsWith('--')) {
+      throw new Error(`Unknown option: ${arg}; put filenames after --`);
+    } else {
+      files.push(arg);
+    }
+  }
+  if (inputMode) {
+    if (files.length) throw new Error('Do not mix stdin and file arguments');
+    files.push(...readFileSync(0, 'utf8').split(inputMode === '--stdin0' ? '\0' : '\n').filter(Boolean));
+  }
+  console.log(JSON.stringify(riskPaths(files, diffText)));
+}
+
+if (process.argv[1] === fileURLToPath(import.meta.url)) main(process.argv.slice(2));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@olegkoval/agent-skills",
-  "version": "1.66.0",
+  "version": "1.68.0",
   "private": false,
   "publishConfig": {
     "access": "public"

package/plugins/olko-apple-kit/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-apple-kit",
   "description": "Build and ship Apple platform apps: macOS menubar apps, App Store submissions.",
-  "version": "1.66.0",
+  "version": "1.68.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-creative/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-creative",
   "description": "Creative and personal projects: photo galleries, music players, listings, wiki editing.",
-  "version": "1.66.0",
+  "version": "1.68.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-garmin-kit/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-garmin-kit",
   "description": "Build, test and publish Garmin Connect IQ watch faces.",
-  "version": "1.66.0",
+  "version": "1.68.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-git-tools/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-git-tools",
   "description": "Everyday git and GitHub CLI operations: conventional commits, branch hygiene.",
-  "version": "1.66.0",
+  "version": "1.68.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-github-pr/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-github-pr",
   "description": "Drive GitHub pull requests to merge-ready: review-bot loops, CI fixes, descriptions, dependency triage.",
-  "version": "1.66.0",
+  "version": "1.68.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-github-pr/skills/lekker-review/README.md

@@ -60,3 +60,13 @@ the diff touches migrations or `*.sql`, `medium` otherwise.
 
 The posters are self-contained HTML in `assets/`. Open either file in a browser
 at a 1280x720 viewport and screenshot it to regenerate the PNG.
+
+## Pre-push review label
+
+Branch-mode reviews can apply `reviewed-before-push` after pushing and opening
+or locating the PR. A comment records the reviewed commit, engine, depth, and
+result; unresolved Critical/Important findings prevent labeling. Install the
+[cleanup workflow](references/reviewed-before-push.yml) on the target repo's
+default branch first so new, unreviewed commits lose the label. See the
+[receipt and setup procedure](references/reviewed-before-push.md). This label
+provides visibility and does not replace required remote review or CI.

package/plugins/olko-github-pr/skills/lekker-review/SKILL.md

@@ -284,23 +284,49 @@ Then:
 `LOCAL_BRANCH` is `main`, `master`, `develop`, `staging`, or `production`, stop
 and say so.
 
-**Depth:** explicit keyword `scan`, `medium`, `deep` or `deps` wins. If absent,
-get the per-file stat - in `pr` mode from
-`gh pr view <PR_NUMBER> --repo <REPO_SLUG> --json additions,deletions,changedFiles,files,baseRefName,state,mergeCommit`
-(keep `baseRefName` as `BASE_BRANCH` and `changedFiles` as `EXPECTED_FILES` for
-Track A; when `state` is `MERGED`, keep `mergeCommit.oid` as `MERGE_COMMIT`), in `branch` mode from `git diff --numstat <MERGE_BASE> HEAD` - and
-apply AUTO-DEPTH. Lockfiles (`package-lock.json`, `npm-shrinkwrap.json`,
-`yarn.lock`, `pnpm-lock.yaml`, `bun.lock`, `bun.lockb`) do NOT count toward
-additions+deletions: a regenerated lockfile is thousands of lines nobody reads.
-- `deps` (candidate) if every changed file is a lockfile or a `package.json`.
-  Confirmed after Track A by `scripts/deps-only.mjs` (see "Confirm deps depth");
-  until then run Track B as for `scan`.
-- `scan` if additions+deletions < 150 AND changedFiles <= 5
-- `deep` if additions+deletions > 800 OR changedFiles > 25 OR diff touches
-  `migrations/` or `*.sql`
-- `medium` otherwise
-
-State the chosen depth (and whether it was auto-selected) in the review header.
+**Depth:** record an explicit `scan`, `medium`, `deep` or `deps` request;
+otherwise select a provisional depth from the per-file stats. In `pr` mode use
+`gh pr view <PR_NUMBER> --repo <REPO_SLUG> --json additions,deletions,changedFiles,files,baseRefName,state,mergeCommit`.
+Keep `baseRefName` as `BASE_BRANCH`, `changedFiles` as `EXPECTED_FILES`, and
+`mergeCommit.oid` as `MERGE_COMMIT` when merged. In `branch` mode use
+`git diff --numstat <MERGE_BASE> HEAD`.
+
+**Mandatory risk check (every depth, including explicit requests):** after
+Track B has saved `pr.diff`, and before finalizing depth or starting Step 2,
+run `scripts/risk-paths.mjs` with that diff and the exact changed paths.
+Resolve the script beside the selected `SKILL.md`: in Codex use
+`<directory containing selected SKILL.md>/scripts/risk-paths.mjs`; in Claude
+use `${CLAUDE_PLUGIN_ROOT}/skills/lekker-review/scripts/risk-paths.mjs`.
+Use a shell-free process API with separate arguments:
+`execFileSync('node', [riskScript, '--diff', diffFile, '--', ...changedPaths])`.
+Never interpolate PR-controlled paths into shell source. Alternatively pipe
+`git diff --name-only -z <MERGE_BASE> HEAD` into
+`node "<resolved riskScript>" --stdin0 --diff "<scratchpad>/pr.diff"`.
+Do not continue on classifier failure; report risk classification unavailable.
+
+The classifier detects configured path patterns for CI workflows, auth,
+billing, installers/setup, and P21, plus `p21` in added lines. These are path
+heuristics, not complete detection of auth/billing behavior in generic files;
+reviewers still inspect that behavior in the diff. Whenever
+`needsHumanReview: true`, always put `NEEDS HUMAN REVIEW: <categories>` in the
+review header, even for an explicit scan. A human must read those paths.
+
+Explicit depth wins, but never suppresses this marker. Without an explicit
+request, apply AUTO-DEPTH in this order after the risk check:
+- `deep` if the classifier returns `deep: true`, additions+deletions > 800,
+  changedFiles > 25, or the diff touches `migrations/` or `*.sql`.
+- `deps` (candidate) if every changed file is a lockfile or `package.json`.
+  Confirm after Track A with `scripts/deps-only.mjs`; until then run Track B
+  as for `scan`.
+- `scan` if additions+deletions < 150 AND changedFiles <= 5.
+- `medium` otherwise.
+
+Lockfiles (`package-lock.json`, `npm-shrinkwrap.json`, `yarn.lock`,
+`pnpm-lock.yaml`, `bun.lock`, `bun.lockb`) do not count toward additions+deletions.
+Step 0 depth is provisional: if the mandatory check upgrades scan, run Track A
+and gather the newly required Track B sources before Step 2. Branch mode uses
+Track A's merge-base diff. State final depth and whether auto-selected in the
+review header.
 
 **`--post` flag:** parse and store as `POST_REVIEW=true`.
 
@@ -672,7 +698,7 @@ Write `<scratchpad>/context.json` with keys:
   "botPatternsFile": "<BOT_PATTERNS_FILE, or null>",
   "depsReport":      "<deps-report.json contents at depth deps, else null>",
   "depsInstall":     "<worktree.json depsInstall>",
-  "prBody":          "<PR body at depth deps, else omit>"
+  "prBody":          "<full PR body at every depth; empty string in branch mode>"
 }
 ```
 
@@ -1112,8 +1138,17 @@ printf '%s\n' "$REVIEW_FILE" > ~/.cache/lekker-review/reviewed/<headSha>
 ```
 
 Write it against the sha that was actually reviewed. When fix mode later adds
-commits, write a marker for the NEW head sha too - a gate keys on the tip
-that is about to be pushed, and a marker for a superseded sha would be a lie.
+commits, write a marker for the new head only after fix verification and
+relevant tests pass. Any unrelated edits require a fresh review; never copy a
+marker to an unreviewed SHA.
+
+**PR label for branch reviews:** follow `references/reviewed-before-push.md`.
+After a complete, non-degraded local review and settling all Critical/Important
+findings, save the final-head receipt as `<scratchpad>/pre-push-review.json`
+BEFORE pushing. That reference defines the receipt schema and one-time cleanup
+workflow setup. The label is exactly `reviewed-before-push` (no AI prefix).
+A legacy SHA/path marker alone does not qualify. PR-mode reviews cannot earn
+this label.
 
 **Close the run log** right after the receipt, then print the review:
 
@@ -1287,33 +1322,42 @@ Ask once, via AskUserQuestion:
 
 Rules for each answer:
 
-- **Yes:** push with `git push -u origin "$local_branch"`, then create the PR
+- **Yes:** set `PREDICTED_AT=$(date -u +%Y-%m-%dT%H:%M:%SZ)` before pushing
+  or publishing, including when a PR already exists. Then push with
+  `git push -u origin "$local_branch"` and create or locate the PR. Create it
   with `gh pr create --repo "$repo_slug" --base "$base_ref" --head
   "$local_branch" --title "$pr_title" --body-file "$pr_body_file"`. Derive the title
   from the commit log (the recommended prefix plus a summary of the change) and
   the body from a short summary of what the branch does - do not leave either
-  as a placeholder. Report the PR url. Then record the prediction against the
-  new PR number - a branch-mode review is the ideal case for this, because the
-  prediction provably predates every bot comment. Record only the findings fix
+  as a placeholder. Report the PR url. If an eligible pre-push receipt was
+  saved, publish it using `scripts/review-label.mjs` as described in
+  `references/reviewed-before-push.md`. This posts the commit/engine/depth/result
+  evidence and applies `reviewed-before-push` only to the matching live head.
+  If cleanup is not installed, omit the label and report the setup requirement;
+  do not undo the successful PR creation. For an existing PR found after a
+  branch-mode push, use the same helper and head check. Then record the prediction
+  against the created or existing PR number using the saved `PREDICTED_AT`;
+  scoring uses it to include bot comments triggered by the push or PR creation,
+  even if they arrive before the record step. Record only the findings fix
   mode did NOT apply (every row of the fixes table that is not `✅ applied`):
   an applied fix is gone from the code the bots read, so they cannot raise it,
   and recording it would sink precision for doing exactly what branch mode is
   for. Build `<scratchpad>/unfixed.json` (a bare array is fine) from the merged
   `findings.json` minus the findings fix mode applied; when fix mode did not
-  run or applied nothing, it is the whole merged set. Take
-  `PREDICTED_AT=$(date -u +%Y-%m-%dT%H:%M:%SZ)` just BEFORE `gh pr create`, so
-  a bot comment that lands before the record step still counts:
+  run or applied nothing, it is the whole merged set. Keep the timestamp captured
+  before the push; do not replace it at the record step:
 
   ```bash
   node ${SKILL_ROOT}/scripts/bot-precision.mjs record \
-    --repo "$repo_slug" --pr <NEW_PR_NUMBER> --predicted <scratchpad>/unfixed.json \
+    --repo "$repo_slug" --pr <PR_NUMBER> --predicted <scratchpad>/unfixed.json \
     --at "$PREDICTED_AT"
   ```
 
   The review is already saved locally; offer `--post` on the new PR number only if the user asks - findings that fix
   mode already applied must never be posted as review comments.
 - **Push only:** `git push -u origin "$local_branch"` and stop. Say in one line
-  that no PR was created.
+  that no PR was created. Keep any eligible pre-push receipt for publication
+  when a matching PR is later created; no PR means no label yet.
 - **No:** stop. Print the branch name and the review file path.
 
 **Unattended runs never ask and never create a PR** (see the operating contract

package/plugins/olko-github-pr/skills/lekker-review/references/agents/implementation.md

@@ -48,6 +48,22 @@ Axes to cover:
   fixed, the mitigation fully resolves the defect, or the PR is not a bug fix.
 - Integration Contracts: Shopify API misuse, BC API assumptions, webhook
   idempotency, external API pagination not handled.
+- Rollout safety (external writes): when the diff changes what is WRITTEN to
+  another system (an API payload, field mapping, or a DB write into a system
+  this service does not own), state whether the PR has a feature flag
+  (Reflag / `getShopFlag` / `isEnabled` style check around the new write) or a
+  documented revert plan (PR body or code comment). Look in the diff and in the
+  PR body in CONTEXT_FILE. When WORKTREE_PATH is available, trace the changed
+  write through unchanged callers and flag guards before deciding either is
+  absent. Without a worktree, absence from the diff is not proof: report a
+  missing rollout control only when the diff demonstrates that the changed
+  write bypasses a guard and the PR body provides no revert plan. Otherwise
+  mark rollout verification unavailable rather than inventing a finding.
+  If neither control exists on that evidence, report an `important` finding:
+  `title` starts "No flag or revert plan for external write", `badCode` quotes
+  the changed write, `fix` names the flag guard to add. A pure UI/copy change or
+  a write that is trivially undone by deploying again is exempt. Quiet when the
+  flag or plan is present; do not report its presence.
 
 Boundary contract and lifecycle map (required for every Critical/Important
 finding involving routing, persistence, caching, fallback, proxying, or an

package/plugins/olko-github-pr/skills/lekker-review/references/agents/triage-logic.md

@@ -11,6 +11,22 @@ Axes to cover (Critical/Important only):
 - Scalability: N+1 queries, missing pagination, unbounded collections, missing rate-limit
 - Integration Contracts: Shopify API misuse, webhook idempotency not handled
 - Correctness: off-by-one, wrong operator, missing null guard
+- Rollout safety (external writes): when the diff changes what is WRITTEN to
+  another system (an API payload, field mapping, or a DB write into a system
+  this service does not own), state whether the PR has a feature flag
+  (Reflag / `getShopFlag` / `isEnabled` style check around the new write) or a
+  documented revert plan (PR body or code comment). Look in the diff and in the
+  PR body in CONTEXT_FILE. When WORKTREE_PATH is available, trace the changed
+  write through unchanged callers and flag guards before deciding either is
+  absent. Without a worktree, absence from the diff is not proof: report a
+  missing rollout control only when the diff demonstrates that the changed
+  write bypasses a guard and the PR body provides no revert plan. Otherwise
+  mark rollout verification unavailable rather than inventing a finding.
+  If neither control exists on that evidence, report an `important` finding:
+  `title` starts "No flag or revert plan for external write", `badCode` quotes
+  the changed write, `fix` names the flag guard to add. A pure UI/copy change or
+  a write that is trivially undone by deploying again is exempt. Quiet when the
+  flag or plan is present; do not report its presence.
 
 CI_STATUS: read key "ciStatus" from the JSON file CONTEXT_FILE.
 EXISTING_REVIEWS: read key "existingReviews" from CONTEXT_FILE (awareness only, skip findings at same file:line)

package/plugins/olko-github-pr/skills/lekker-review/references/output-format.md

@@ -24,6 +24,7 @@ Output the review as a markdown response (not via printf). No ANSI escapes.
 **Proofs:** <M proven / N attempted> *(include only when N > 0)*
 **CI:** <✅ All passing | ⚠️ N failing: check-name | ⏳ Pending | N/A>
 **Depth:** <📦 deps | ⚡ scan | 🔍 medium | 🔬 deep>
+**NEEDS HUMAN REVIEW:** <categories from risk-paths.mjs> *(only when `needsHumanReview` is true: a person must read these paths whatever the verdict)*
 **Engine:** <workflow | codex | revmux>
 
 ---

package/plugins/olko-github-pr/skills/lekker-review/references/reviewed-before-push.md

@@ -0,0 +1,94 @@
+# Reviewed before push
+
+`reviewed-before-push` records a completed local branch review of the current
+PR head. It is informational: it does not satisfy CI, required remote review,
+or the human-review marker for risky changes. The review comment records the
+full head/base SHAs, engine, depth, timestamp, and result. It is an attestation
+by the publishing user, not cryptographic proof that review preceded a push.
+
+## Install stale-label cleanup once per repository
+
+Copy `references/reviewed-before-push.yml` into the target repository as
+`.github/workflows/reviewed-before-push.yml` and land it on the default branch
+through that repository's normal review process. Do this before the local
+review whose receipt will be published. Do not add a workflow commit after
+review and then label that unreviewed commit.
+
+The workflow uses only GitHub API data, with no PR checkout. On new commits or
+receipt edits/deletion it removes the label unless a receipt from an owner,
+member, or collaborator matches the live head. Pagination includes all receipt
+comments. It does not add labels or replace merge gates. A newly reviewed head
+can be labeled again by the publisher. Cleanup is asynchronous; the label is
+not a merge-authorization signal. Workflows disabled by repository policy or
+Actions outages can delay removal.
+
+The helper refuses to publish if the cleanup workflow is absent. If setup is
+missing, keep the local review and PR creation successful, omit the label, and
+report the missing setup. Never silently install a write-capable workflow in
+another repository. A push-only run keeps the receipt locally until a PR exists.
+
+## Record before pushing
+
+Only in `MODE=branch`, after the review engine completed without degraded or
+missing required dimensions, settle every Critical/Important finding. Either
+fix it with verifier/test evidence or explicitly rebut it with a reason. Open
+observations may remain. A file containing only a review path or a SHA marker
+is not sufficient evidence.
+
+Save `<scratchpad>/pre-push-review.json` before the push:
+
+```json
+{
+  "version": 1,
+  "mode": "branch",
+  "result": "passed",
+  "headSha": "<full reviewed final local HEAD>",
+  "baseSha": "<full merge-base used by this review>",
+  "engine": "codex",
+  "depth": "medium",
+  "reviewedAt": "<UTC ISO timestamp when this review completed>",
+  "findings": [
+    {
+      "severity": "important",
+      "disposition": "fixed",
+      "evidence": "<actual fix verification and relevant test result>"
+    }
+  ]
+}
+```
+
+Use an empty `findings` array when the review found nothing. Otherwise include
+every finding in the merged review and lint set. Allowed dispositions are
+`fixed`, `rebutted`, and `open`; `open` is permitted only for observations and
+idiomatic suggestions. Rebuttals require specific evidence too. Set engine and
+depth to the values actually used. Keep the saved full review locally; finding
+text, evidence text, and local paths are not uploaded by the helper.
+
+`reviewedAt` must be a valid UTC ISO timestamp in `YYYY-MM-DDTHH:mm:ssZ`
+format, optionally with fractional seconds before `Z` (for example,
+`2026-10-29T09:00:00.123Z`). Date-only strings, timezone offsets, and invalid
+calendar dates are rejected by the publisher and cleanup workflow.
+
+After fixes, the receipt must describe the final SHA: fix verification and
+relevant tests must pass, and the only intervening edits must be those verified
+fixes. Any unrelated edit requires a fresh review. Never copy a receipt to a
+new SHA just to make the label apply.
+
+## Publish after pushing and creating or locating the PR
+
+Resolve the helper relative to the selected `SKILL.md` (same directory's
+`scripts/review-label.mjs`, including in Codex). Invoke with separate process
+arguments, or independently shell-quote each value:
+
+```bash
+node "<SKILL_ROOT>/scripts/review-label.mjs" \
+  --repo "<owner/repo>" --pr "<number>" \
+  --receipt "<scratchpad>/pre-push-review.json"
+```
+
+The helper checks the live open PR head, posts the receipt, creates the label
+if needed, and applies it. It checks the head before and after labeling, and
+removes the label if a concurrent push changed the head. Errors are failures
+to publish the label, not a failed local review. Do not claim the label was
+applied when the helper failed. Do not use this helper for a review performed
+in `MODE=pr` after pushing.

package/plugins/olko-github-pr/skills/lekker-review/references/reviewed-before-push.yml

@@ -0,0 +1,57 @@
+# Install this file on the target repository's default branch as
+# .github/workflows/reviewed-before-push.yml before publishing review labels.
+name: Reviewed before push
+on:
+  pull_request_target:
+    types: [opened, reopened, synchronize, edited, labeled]
+  issue_comment:
+    types: [created, edited, deleted]
+permissions:
+  contents: read
+  issues: write
+  pull-requests: read
+concurrency:
+  group: reviewed-before-push-${{ github.event.pull_request.number || github.event.issue.number }}
+  cancel-in-progress: false
+jobs:
+  reconcile:
+    if: github.event.pull_request || github.event.issue.pull_request
+    runs-on: ubuntu-latest
+    steps:
+      # No checkout: never execute code from the PR with this write token.
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const label = 'reviewed-before-push';
+            function isUtcTimestamp(value) {
+              const match = typeof value === 'string' && value.match(/^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2})(?:\.(\d+))?Z$/);
+              if (!match || match[0] !== value) return false;
+              const time = Date.parse(value);
+              const canonical = `${match[1]}.${(match[2] || '').padEnd(3, '0').slice(0, 3)}Z`;
+              return Number.isFinite(time) && new Date(time).toISOString() === canonical;
+            }
+            const { owner, repo } = context.repo;
+            const issue_number = context.payload.pull_request?.number || context.payload.issue.number;
+            const { data: pr } = await github.rest.pulls.get({ owner, repo, pull_number: issue_number });
+            if (!pr.labels.some(item => item.name === label)) return;
+            const comments = await github.paginate(github.rest.issues.listComments, { owner, repo, issue_number, per_page: 100 });
+            const valid = comments.some(comment => {
+              if (!['OWNER', 'MEMBER', 'COLLABORATOR'].includes(comment.author_association)) return false;
+              const match = comment.body?.match(/<!-- lekker:reviewed-before-push (\{[^\n]*\}) -->/);
+              if (!match) return false;
+              try {
+                const r = JSON.parse(match[1]);
+                return r.version === 1 && r.mode === 'branch' && r.result === 'passed'
+                  && r.headSha === pr.head.sha && /^[a-f0-9]{40}$/.test(r.baseSha)
+                  && ['workflow', 'codex', 'revmux'].includes(r.engine)
+                  && ['scan', 'medium', 'deep', 'deps'].includes(r.depth)
+                  && isUtcTimestamp(r.reviewedAt);
+              } catch { return false; }
+            });
+            if (!valid) {
+              try {
+                await github.rest.issues.removeLabel({ owner, repo, issue_number, name: label });
+              } catch (error) {
+                if (error.status !== 404) throw error;
+              }
+            }

package/plugins/olko-github-pr/skills/lekker-review/scripts/review-label.mjs

@@ -0,0 +1,90 @@
+#!/usr/bin/env node
+// Publish a local branch-review receipt using gh; PR-controlled values never enter shell source.
+import { execFileSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+
+export const LABEL = 'reviewed-before-push';
+export const PREFIX = '<!-- lekker:reviewed-before-push ';
+const SHA = /^[a-f0-9]{40}$/;
+
+function isUtcTimestamp(value) {
+  const match = typeof value === 'string' && value.match(/^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2})(?:\.(\d+))?Z$/);
+  if (!match || match[0] !== value) return false;
+  const time = Date.parse(value);
+  const canonical = `${match[1]}.${(match[2] || '').padEnd(3, '0').slice(0, 3)}Z`;
+  return Number.isFinite(time) && new Date(time).toISOString() === canonical;
+}
+
+export function validateReceipt(receipt) {
+  if (receipt?.version !== 1 || receipt.mode !== 'branch' || receipt.result !== 'passed'
+      || !SHA.test(receipt.headSha) || !SHA.test(receipt.baseSha)
+      || !['workflow', 'codex', 'revmux'].includes(receipt.engine)
+      || !['scan', 'medium', 'deep', 'deps'].includes(receipt.depth)
+      || !isUtcTimestamp(receipt.reviewedAt)
+      || !Array.isArray(receipt.findings)) {
+    throw new Error('Invalid branch-review receipt');
+  }
+  for (const finding of receipt.findings) {
+    if (!['critical', 'important', 'observation', 'idiomatic'].includes(finding.severity)
+        || !['fixed', 'rebutted', 'open'].includes(finding.disposition)
+        || (['critical', 'important'].includes(finding.severity) && finding.disposition === 'open')
+        || (['fixed', 'rebutted'].includes(finding.disposition) && !finding.evidence?.trim())) {
+      throw new Error('Findings require dispositions and evidence; no open Critical/Important finding is allowed');
+    }
+  }
+  return receipt;
+}
+
+export function reviewComment(receipt) {
+  validateReceipt(receipt);
+  // Only publish the attestation, not local paths or potentially sensitive finding text.
+  const { version, mode, result, headSha, baseSha, engine, depth, reviewedAt } = receipt;
+  const attestation = { version, mode, result, headSha, baseSha, engine, depth, reviewedAt };
+  return `Reviewed before push\n\nCommit: \`${headSha}\`\nBase: \`${baseSha}\`\nEngine: ${engine}\nDepth: ${depth}\nReviewed at: ${reviewedAt}\nResult: passed; no unresolved Critical/Important findings.\n\nThis records a local review; required CI and remote review gates still apply.\n\n${PREFIX}${JSON.stringify(attestation)} -->`;
+}
+
+export function publishReview({ repo, pr, receipt }, run = execFileSync) {
+  if (!/^[\w.-]+\/[\w.-]+$/.test(repo) || !/^[1-9]\d*$/.test(String(pr))) {
+    throw new Error('Expected --repo owner/repo and a positive --pr number');
+  }
+  const body = reviewComment(receipt);
+  const gh = (args, input) => run('gh', args, { encoding: 'utf8', input });
+  const readHead = () => JSON.parse(gh(['pr', 'view', String(pr), '--repo', repo, '--json', 'headRefOid,state']));
+  const ensureCurrent = () => {
+    const current = readHead();
+    if (current.state !== 'OPEN' || current.headRefOid !== receipt.headSha) {
+      throw new Error('PR is closed or its head differs from the reviewed commit; label withheld');
+    }
+  };
+  ensureCurrent();
+  // The installation is explicit: do not silently add a privileged workflow to someone else's repo.
+  gh(['api', `repos/${repo}/contents/.github/workflows/reviewed-before-push.yml`]);
+  gh(['api', '--method', 'POST', `repos/${repo}/issues/${pr}/comments`, '--input', '-'], JSON.stringify({ body }));
+  gh(['label', 'create', LABEL, '--repo', repo, '--color', '0E8A16', '--description', 'Local review completed for the current PR head before push', '--force']);
+  ensureCurrent();
+  gh(['pr', 'edit', String(pr), '--repo', repo, '--add-label', LABEL]);
+  // Catch a concurrent push after adding the label. The workflow also reconciles later pushes.
+  try {
+    ensureCurrent();
+  } catch (error) {
+    gh(['pr', 'edit', String(pr), '--repo', repo, '--remove-label', LABEL]);
+    throw error;
+  }
+  return { label: LABEL, headSha: receipt.headSha };
+}
+
+function main(argv) {
+  const options = {};
+  for (let i = 0; i < argv.length; i += 2) {
+    if (!['--repo', '--pr', '--receipt'].includes(argv[i]) || !argv[i + 1] || options[argv[i]]) {
+      throw new Error('Usage: review-label.mjs --repo owner/repo --pr N --receipt receipt.json');
+    }
+    options[argv[i]] = argv[i + 1];
+  }
+  if (!options['--receipt']) throw new Error('--receipt is required');
+  const receipt = JSON.parse(readFileSync(options['--receipt'], 'utf8'));
+  console.log(JSON.stringify(publishReview({ repo: options['--repo'], pr: options['--pr'], receipt })));
+}
+
+if (process.argv[1] === fileURLToPath(import.meta.url)) main(process.argv.slice(2));

package/plugins/olko-github-pr/skills/lekker-review/scripts/risk-paths.mjs

@@ -0,0 +1,67 @@
+#!/usr/bin/env node
+// Path-based risk for AUTO-DEPTH. Size alone misses the small PRs that matter:
+// a 10-line change to a workflow file, a session check or a P21 mapping.
+//
+// Usage:
+//   node risk-paths.mjs [--diff <pr.diff>] -- <changed-file>...
+//   git diff --name-only -z <base>...HEAD | node risk-paths.mjs --stdin0 --diff <pr.diff>
+// Use a shell-free process API for file arguments; never interpolate PR paths.
+//
+// Prints {"deep": bool, "needsHumanReview": bool, "categories": [{category, files}]}.
+// `--diff` also lets the identifier `p21` count when it only appears in added lines.
+
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+
+export const RISK_RULES = [
+  { category: 'ci-workflow', test: (f) => /^\.github\/workflows\//.test(f) },
+  { category: 'auth', test: (f) => /(^|[/._-])(auth|authn|authz|authenticate|authenticated|authentication|authorize|authorized|authorization|oauth|session|sessions|permission|permissions|rbac|acl|jwt|login)([/._-]|$)/i.test(f.replace(/([a-z0-9])([A-Z])/g, '$1-$2')) },
+  { category: 'billing', test: (f) => /(billing|payment|payments|invoice|invoices|checkout|stripe|subscription)/i.test(f) },
+  { category: 'installer', test: (f) => /(^|\/)(install|setup|bootstrap|preinstall|postinstall)(?:[^/.]*|[^/]*\.(sh|bash|zsh|ps1|js|mjs|cjs|ts|py|bat|cmd))$/i.test(f) },
+  { category: 'p21', test: (f) => /p21/i.test(f) },
+];
+
+export function addedLinesMention(diffText, pattern) {
+  return diffText.split('\n').some((l) => l.startsWith('+') && !l.startsWith('+++') && pattern.test(l));
+}
+
+export function riskPaths(files, diffText = '') {
+  const categories = RISK_RULES
+    .map((rule) => ({ category: rule.category, files: files.filter(rule.test) }))
+    .map((c) => (c.category === 'p21' && c.files.length === 0 && addedLinesMention(diffText, /p21/i)
+      ? { ...c, files: ['(identifier p21 in added lines)'] }
+      : c))
+    .filter((c) => c.files.length > 0);
+  return { deep: categories.length > 0, needsHumanReview: categories.length > 0, categories };
+}
+
+function main(argv) {
+  let diffText = '';
+  let inputMode = null;
+  const files = [];
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === '--') {
+      files.push(...argv.slice(i + 1));
+      break;
+    }
+    if (arg === '--diff') {
+      if (!argv[i + 1] || argv[i + 1] === '--') throw new Error('--diff requires a file');
+      diffText = readFileSync(argv[++i], 'utf8');
+    } else if (arg === '--stdin' || arg === '--stdin0') {
+      if (inputMode) throw new Error('Choose only one stdin mode');
+      inputMode = arg;
+    } else if (arg.startsWith('--')) {
+      throw new Error(`Unknown option: ${arg}; put filenames after --`);
+    } else {
+      files.push(arg);
+    }
+  }
+  if (inputMode) {
+    if (files.length) throw new Error('Do not mix stdin and file arguments');
+    files.push(...readFileSync(0, 'utf8').split(inputMode === '--stdin0' ? '\0' : '\n').filter(Boolean));
+  }
+  console.log(JSON.stringify(riskPaths(files, diffText)));
+}
+
+if (process.argv[1] === fileURLToPath(import.meta.url)) main(process.argv.slice(2));

package/plugins/olko-obsidian/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-obsidian",
   "description": "Keep an Obsidian vault in sync with work: PR sync, task rollover, morning routine.",
-  "version": "1.66.0",
+  "version": "1.68.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-product/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-product",
   "description": "Take a product idea to a shippable build: MVP passes, full-stack scaffolds, UX/UI quality loops, launch plans.",
-  "version": "1.66.0",
+  "version": "1.68.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-reflection/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-reflection",
   "description": "Look back and improve: self-critique, retrospectives, performance review, rapid learning.",
-  "version": "1.66.0",
+  "version": "1.68.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-release/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-release",
   "description": "Ship a release: semantic-release setup, changelogs, store listing copy, release-day routine.",
-  "version": "1.66.0",
+  "version": "1.68.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-skill-meta/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-skill-meta",
   "description": "Author and maintain agent skills and the AI toolchain itself.",
-  "version": "1.66.0",
+  "version": "1.68.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-web-ops/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-web-ops",
   "description": "Operate a website: WAF rules, search console audits, analytics bootstrap, docs indexes.",
-  "version": "1.66.0",
+  "version": "1.68.0",
   "author": {
     "name": "Oleg Koval"
   },