@olegkoval/agent-skills 1.67.0 → 1.68.0

package/adapters/claude/olko-github-pr/skills/lekker-review/SKILL.md

@@ -1139,8 +1139,17 @@ printf '%s\n' "$REVIEW_FILE" > ~/.cache/lekker-review/reviewed/<headSha>
 ```
 
 Write it against the sha that was actually reviewed. When fix mode later adds
-commits, write a marker for the NEW head sha too - a gate keys on the tip
-that is about to be pushed, and a marker for a superseded sha would be a lie.
+commits, write a marker for the new head only after fix verification and
+relevant tests pass. Any unrelated edits require a fresh review; never copy a
+marker to an unreviewed SHA.
+
+**PR label for branch reviews:** follow `references/reviewed-before-push.md`.
+After a complete, non-degraded local review and settling all Critical/Important
+findings, save the final-head receipt as `<scratchpad>/pre-push-review.json`
+BEFORE pushing. That reference defines the receipt schema and one-time cleanup
+workflow setup. The label is exactly `reviewed-before-push` (no AI prefix).
+A legacy SHA/path marker alone does not qualify. PR-mode reviews cannot earn
+this label.
 
 **Close the run log** right after the receipt, then print the review:
 
@@ -1314,33 +1323,42 @@ Ask once, via AskUserQuestion:
 
 Rules for each answer:
 
-- **Yes:** push with `git push -u origin "$local_branch"`, then create the PR
+- **Yes:** set `PREDICTED_AT=$(date -u +%Y-%m-%dT%H:%M:%SZ)` before pushing
+  or publishing, including when a PR already exists. Then push with
+  `git push -u origin "$local_branch"` and create or locate the PR. Create it
   with `gh pr create --repo "$repo_slug" --base "$base_ref" --head
   "$local_branch" --title "$pr_title" --body-file "$pr_body_file"`. Derive the title
   from the commit log (the recommended prefix plus a summary of the change) and
   the body from a short summary of what the branch does - do not leave either
-  as a placeholder. Report the PR url. Then record the prediction against the
-  new PR number - a branch-mode review is the ideal case for this, because the
-  prediction provably predates every bot comment. Record only the findings fix
+  as a placeholder. Report the PR url. If an eligible pre-push receipt was
+  saved, publish it using `scripts/review-label.mjs` as described in
+  `references/reviewed-before-push.md`. This posts the commit/engine/depth/result
+  evidence and applies `reviewed-before-push` only to the matching live head.
+  If cleanup is not installed, omit the label and report the setup requirement;
+  do not undo the successful PR creation. For an existing PR found after a
+  branch-mode push, use the same helper and head check. Then record the prediction
+  against the created or existing PR number using the saved `PREDICTED_AT`;
+  scoring uses it to include bot comments triggered by the push or PR creation,
+  even if they arrive before the record step. Record only the findings fix
   mode did NOT apply (every row of the fixes table that is not `✅ applied`):
   an applied fix is gone from the code the bots read, so they cannot raise it,
   and recording it would sink precision for doing exactly what branch mode is
   for. Build `<scratchpad>/unfixed.json` (a bare array is fine) from the merged
   `findings.json` minus the findings fix mode applied; when fix mode did not
-  run or applied nothing, it is the whole merged set. Take
-  `PREDICTED_AT=$(date -u +%Y-%m-%dT%H:%M:%SZ)` just BEFORE `gh pr create`, so
-  a bot comment that lands before the record step still counts:
+  run or applied nothing, it is the whole merged set. Keep the timestamp captured
+  before the push; do not replace it at the record step:
 
   ```bash
   node ${SKILL_ROOT}/scripts/bot-precision.mjs record \
-    --repo "$repo_slug" --pr <NEW_PR_NUMBER> --predicted <scratchpad>/unfixed.json \
+    --repo "$repo_slug" --pr <PR_NUMBER> --predicted <scratchpad>/unfixed.json \
     --at "$PREDICTED_AT"
   ```
 
   The review is already saved locally; offer `--post` on the new PR number only if the user asks - findings that fix
   mode already applied must never be posted as review comments.
 - **Push only:** `git push -u origin "$local_branch"` and stop. Say in one line
-  that no PR was created.
+  that no PR was created. Keep any eligible pre-push receipt for publication
+  when a matching PR is later created; no PR means no label yet.
 - **No:** stop. Print the branch name and the review file path.
 
 **Unattended runs never ask and never create a PR** (see the operating contract

package/adapters/claude/olko-github-pr/skills/lekker-review/references/reviewed-before-push.md

@@ -0,0 +1,94 @@
+# Reviewed before push
+
+`reviewed-before-push` records a completed local branch review of the current
+PR head. It is informational: it does not satisfy CI, required remote review,
+or the human-review marker for risky changes. The review comment records the
+full head/base SHAs, engine, depth, timestamp, and result. It is an attestation
+by the publishing user, not cryptographic proof that review preceded a push.
+
+## Install stale-label cleanup once per repository
+
+Copy `references/reviewed-before-push.yml` into the target repository as
+`.github/workflows/reviewed-before-push.yml` and land it on the default branch
+through that repository's normal review process. Do this before the local
+review whose receipt will be published. Do not add a workflow commit after
+review and then label that unreviewed commit.
+
+The workflow uses only GitHub API data, with no PR checkout. On new commits or
+receipt edits/deletion it removes the label unless a receipt from an owner,
+member, or collaborator matches the live head. Pagination includes all receipt
+comments. It does not add labels or replace merge gates. A newly reviewed head
+can be labeled again by the publisher. Cleanup is asynchronous; the label is
+not a merge-authorization signal. Workflows disabled by repository policy or
+Actions outages can delay removal.
+
+The helper refuses to publish if the cleanup workflow is absent. If setup is
+missing, keep the local review and PR creation successful, omit the label, and
+report the missing setup. Never silently install a write-capable workflow in
+another repository. A push-only run keeps the receipt locally until a PR exists.
+
+## Record before pushing
+
+Only in `MODE=branch`, after the review engine completed without degraded or
+missing required dimensions, settle every Critical/Important finding. Either
+fix it with verifier/test evidence or explicitly rebut it with a reason. Open
+observations may remain. A file containing only a review path or a SHA marker
+is not sufficient evidence.
+
+Save `<scratchpad>/pre-push-review.json` before the push:
+
+```json
+{
+  "version": 1,
+  "mode": "branch",
+  "result": "passed",
+  "headSha": "<full reviewed final local HEAD>",
+  "baseSha": "<full merge-base used by this review>",
+  "engine": "codex",
+  "depth": "medium",
+  "reviewedAt": "<UTC ISO timestamp when this review completed>",
+  "findings": [
+    {
+      "severity": "important",
+      "disposition": "fixed",
+      "evidence": "<actual fix verification and relevant test result>"
+    }
+  ]
+}
+```
+
+Use an empty `findings` array when the review found nothing. Otherwise include
+every finding in the merged review and lint set. Allowed dispositions are
+`fixed`, `rebutted`, and `open`; `open` is permitted only for observations and
+idiomatic suggestions. Rebuttals require specific evidence too. Set engine and
+depth to the values actually used. Keep the saved full review locally; finding
+text, evidence text, and local paths are not uploaded by the helper.
+
+`reviewedAt` must be a valid UTC ISO timestamp in `YYYY-MM-DDTHH:mm:ssZ`
+format, optionally with fractional seconds before `Z` (for example,
+`2026-10-29T09:00:00.123Z`). Date-only strings, timezone offsets, and invalid
+calendar dates are rejected by the publisher and cleanup workflow.
+
+After fixes, the receipt must describe the final SHA: fix verification and
+relevant tests must pass, and the only intervening edits must be those verified
+fixes. Any unrelated edit requires a fresh review. Never copy a receipt to a
+new SHA just to make the label apply.
+
+## Publish after pushing and creating or locating the PR
+
+Resolve the helper relative to the selected `SKILL.md` (same directory's
+`scripts/review-label.mjs`, including in Codex). Invoke with separate process
+arguments, or independently shell-quote each value:
+
+```bash
+node "<SKILL_ROOT>/scripts/review-label.mjs" \
+  --repo "<owner/repo>" --pr "<number>" \
+  --receipt "<scratchpad>/pre-push-review.json"
+```
+
+The helper checks the live open PR head, posts the receipt, creates the label
+if needed, and applies it. It checks the head before and after labeling, and
+removes the label if a concurrent push changed the head. Errors are failures
+to publish the label, not a failed local review. Do not claim the label was
+applied when the helper failed. Do not use this helper for a review performed
+in `MODE=pr` after pushing.

package/adapters/claude/olko-github-pr/skills/lekker-review/references/reviewed-before-push.yml

@@ -0,0 +1,57 @@
+# Install this file on the target repository's default branch as
+# .github/workflows/reviewed-before-push.yml before publishing review labels.
+name: Reviewed before push
+on:
+  pull_request_target:
+    types: [opened, reopened, synchronize, edited, labeled]
+  issue_comment:
+    types: [created, edited, deleted]
+permissions:
+  contents: read
+  issues: write
+  pull-requests: read
+concurrency:
+  group: reviewed-before-push-${{ github.event.pull_request.number || github.event.issue.number }}
+  cancel-in-progress: false
+jobs:
+  reconcile:
+    if: github.event.pull_request || github.event.issue.pull_request
+    runs-on: ubuntu-latest
+    steps:
+      # No checkout: never execute code from the PR with this write token.
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const label = 'reviewed-before-push';
+            function isUtcTimestamp(value) {
+              const match = typeof value === 'string' && value.match(/^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2})(?:\.(\d+))?Z$/);
+              if (!match || match[0] !== value) return false;
+              const time = Date.parse(value);
+              const canonical = `${match[1]}.${(match[2] || '').padEnd(3, '0').slice(0, 3)}Z`;
+              return Number.isFinite(time) && new Date(time).toISOString() === canonical;
+            }
+            const { owner, repo } = context.repo;
+            const issue_number = context.payload.pull_request?.number || context.payload.issue.number;
+            const { data: pr } = await github.rest.pulls.get({ owner, repo, pull_number: issue_number });
+            if (!pr.labels.some(item => item.name === label)) return;
+            const comments = await github.paginate(github.rest.issues.listComments, { owner, repo, issue_number, per_page: 100 });
+            const valid = comments.some(comment => {
+              if (!['OWNER', 'MEMBER', 'COLLABORATOR'].includes(comment.author_association)) return false;
+              const match = comment.body?.match(/<!-- lekker:reviewed-before-push (\{[^\n]*\}) -->/);
+              if (!match) return false;
+              try {
+                const r = JSON.parse(match[1]);
+                return r.version === 1 && r.mode === 'branch' && r.result === 'passed'
+                  && r.headSha === pr.head.sha && /^[a-f0-9]{40}$/.test(r.baseSha)
+                  && ['workflow', 'codex', 'revmux'].includes(r.engine)
+                  && ['scan', 'medium', 'deep', 'deps'].includes(r.depth)
+                  && isUtcTimestamp(r.reviewedAt);
+              } catch { return false; }
+            });
+            if (!valid) {
+              try {
+                await github.rest.issues.removeLabel({ owner, repo, issue_number, name: label });
+              } catch (error) {
+                if (error.status !== 404) throw error;
+              }
+            }

package/adapters/claude/olko-github-pr/skills/lekker-review/scripts/review-label.mjs

@@ -0,0 +1,90 @@
+#!/usr/bin/env node
+// Publish a local branch-review receipt using gh; PR-controlled values never enter shell source.
+import { execFileSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+
+export const LABEL = 'reviewed-before-push';
+export const PREFIX = '<!-- lekker:reviewed-before-push ';
+const SHA = /^[a-f0-9]{40}$/;
+
+function isUtcTimestamp(value) {
+  const match = typeof value === 'string' && value.match(/^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2})(?:\.(\d+))?Z$/);
+  if (!match || match[0] !== value) return false;
+  const time = Date.parse(value);
+  const canonical = `${match[1]}.${(match[2] || '').padEnd(3, '0').slice(0, 3)}Z`;
+  return Number.isFinite(time) && new Date(time).toISOString() === canonical;
+}
+
+export function validateReceipt(receipt) {
+  if (receipt?.version !== 1 || receipt.mode !== 'branch' || receipt.result !== 'passed'
+      || !SHA.test(receipt.headSha) || !SHA.test(receipt.baseSha)
+      || !['workflow', 'codex', 'revmux'].includes(receipt.engine)
+      || !['scan', 'medium', 'deep', 'deps'].includes(receipt.depth)
+      || !isUtcTimestamp(receipt.reviewedAt)
+      || !Array.isArray(receipt.findings)) {
+    throw new Error('Invalid branch-review receipt');
+  }
+  for (const finding of receipt.findings) {
+    if (!['critical', 'important', 'observation', 'idiomatic'].includes(finding.severity)
+        || !['fixed', 'rebutted', 'open'].includes(finding.disposition)
+        || (['critical', 'important'].includes(finding.severity) && finding.disposition === 'open')
+        || (['fixed', 'rebutted'].includes(finding.disposition) && !finding.evidence?.trim())) {
+      throw new Error('Findings require dispositions and evidence; no open Critical/Important finding is allowed');
+    }
+  }
+  return receipt;
+}
+
+export function reviewComment(receipt) {
+  validateReceipt(receipt);
+  // Only publish the attestation, not local paths or potentially sensitive finding text.
+  const { version, mode, result, headSha, baseSha, engine, depth, reviewedAt } = receipt;
+  const attestation = { version, mode, result, headSha, baseSha, engine, depth, reviewedAt };
+  return `Reviewed before push\n\nCommit: \`${headSha}\`\nBase: \`${baseSha}\`\nEngine: ${engine}\nDepth: ${depth}\nReviewed at: ${reviewedAt}\nResult: passed; no unresolved Critical/Important findings.\n\nThis records a local review; required CI and remote review gates still apply.\n\n${PREFIX}${JSON.stringify(attestation)} -->`;
+}
+
+export function publishReview({ repo, pr, receipt }, run = execFileSync) {
+  if (!/^[\w.-]+\/[\w.-]+$/.test(repo) || !/^[1-9]\d*$/.test(String(pr))) {
+    throw new Error('Expected --repo owner/repo and a positive --pr number');
+  }
+  const body = reviewComment(receipt);
+  const gh = (args, input) => run('gh', args, { encoding: 'utf8', input });
+  const readHead = () => JSON.parse(gh(['pr', 'view', String(pr), '--repo', repo, '--json', 'headRefOid,state']));
+  const ensureCurrent = () => {
+    const current = readHead();
+    if (current.state !== 'OPEN' || current.headRefOid !== receipt.headSha) {
+      throw new Error('PR is closed or its head differs from the reviewed commit; label withheld');
+    }
+  };
+  ensureCurrent();
+  // The installation is explicit: do not silently add a privileged workflow to someone else's repo.
+  gh(['api', `repos/${repo}/contents/.github/workflows/reviewed-before-push.yml`]);
+  gh(['api', '--method', 'POST', `repos/${repo}/issues/${pr}/comments`, '--input', '-'], JSON.stringify({ body }));
+  gh(['label', 'create', LABEL, '--repo', repo, '--color', '0E8A16', '--description', 'Local review completed for the current PR head before push', '--force']);
+  ensureCurrent();
+  gh(['pr', 'edit', String(pr), '--repo', repo, '--add-label', LABEL]);
+  // Catch a concurrent push after adding the label. The workflow also reconciles later pushes.
+  try {
+    ensureCurrent();
+  } catch (error) {
+    gh(['pr', 'edit', String(pr), '--repo', repo, '--remove-label', LABEL]);
+    throw error;
+  }
+  return { label: LABEL, headSha: receipt.headSha };
+}
+
+function main(argv) {
+  const options = {};
+  for (let i = 0; i < argv.length; i += 2) {
+    if (!['--repo', '--pr', '--receipt'].includes(argv[i]) || !argv[i + 1] || options[argv[i]]) {
+      throw new Error('Usage: review-label.mjs --repo owner/repo --pr N --receipt receipt.json');
+    }
+    options[argv[i]] = argv[i + 1];
+  }
+  if (!options['--receipt']) throw new Error('--receipt is required');
+  const receipt = JSON.parse(readFileSync(options['--receipt'], 'utf8'));
+  console.log(JSON.stringify(publishReview({ repo: options['--repo'], pr: options['--pr'], receipt })));
+}
+
+if (process.argv[1] === fileURLToPath(import.meta.url)) main(process.argv.slice(2));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@olegkoval/agent-skills",
-  "version": "1.67.0",
+  "version": "1.68.0",
   "private": false,
   "publishConfig": {
     "access": "public"

package/plugins/olko-apple-kit/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-apple-kit",
   "description": "Build and ship Apple platform apps: macOS menubar apps, App Store submissions.",
-  "version": "1.67.0",
+  "version": "1.68.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-creative/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-creative",
   "description": "Creative and personal projects: photo galleries, music players, listings, wiki editing.",
-  "version": "1.67.0",
+  "version": "1.68.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-garmin-kit/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-garmin-kit",
   "description": "Build, test and publish Garmin Connect IQ watch faces.",
-  "version": "1.67.0",
+  "version": "1.68.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-git-tools/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-git-tools",
   "description": "Everyday git and GitHub CLI operations: conventional commits, branch hygiene.",
-  "version": "1.67.0",
+  "version": "1.68.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-github-pr/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-github-pr",
   "description": "Drive GitHub pull requests to merge-ready: review-bot loops, CI fixes, descriptions, dependency triage.",
-  "version": "1.67.0",
+  "version": "1.68.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-github-pr/skills/lekker-review/README.md

@@ -60,3 +60,13 @@ the diff touches migrations or `*.sql`, `medium` otherwise.
 
 The posters are self-contained HTML in `assets/`. Open either file in a browser
 at a 1280x720 viewport and screenshot it to regenerate the PNG.
+
+## Pre-push review label
+
+Branch-mode reviews can apply `reviewed-before-push` after pushing and opening
+or locating the PR. A comment records the reviewed commit, engine, depth, and
+result; unresolved Critical/Important findings prevent labeling. Install the
+[cleanup workflow](references/reviewed-before-push.yml) on the target repo's
+default branch first so new, unreviewed commits lose the label. See the
+[receipt and setup procedure](references/reviewed-before-push.md). This label
+provides visibility and does not replace required remote review or CI.

package/plugins/olko-github-pr/skills/lekker-review/SKILL.md

@@ -1138,8 +1138,17 @@ printf '%s\n' "$REVIEW_FILE" > ~/.cache/lekker-review/reviewed/<headSha>
 ```
 
 Write it against the sha that was actually reviewed. When fix mode later adds
-commits, write a marker for the NEW head sha too - a gate keys on the tip
-that is about to be pushed, and a marker for a superseded sha would be a lie.
+commits, write a marker for the new head only after fix verification and
+relevant tests pass. Any unrelated edits require a fresh review; never copy a
+marker to an unreviewed SHA.
+
+**PR label for branch reviews:** follow `references/reviewed-before-push.md`.
+After a complete, non-degraded local review and settling all Critical/Important
+findings, save the final-head receipt as `<scratchpad>/pre-push-review.json`
+BEFORE pushing. That reference defines the receipt schema and one-time cleanup
+workflow setup. The label is exactly `reviewed-before-push` (no AI prefix).
+A legacy SHA/path marker alone does not qualify. PR-mode reviews cannot earn
+this label.
 
 **Close the run log** right after the receipt, then print the review:
 
@@ -1313,33 +1322,42 @@ Ask once, via AskUserQuestion:
 
 Rules for each answer:
 
-- **Yes:** push with `git push -u origin "$local_branch"`, then create the PR
+- **Yes:** set `PREDICTED_AT=$(date -u +%Y-%m-%dT%H:%M:%SZ)` before pushing
+  or publishing, including when a PR already exists. Then push with
+  `git push -u origin "$local_branch"` and create or locate the PR. Create it
   with `gh pr create --repo "$repo_slug" --base "$base_ref" --head
   "$local_branch" --title "$pr_title" --body-file "$pr_body_file"`. Derive the title
   from the commit log (the recommended prefix plus a summary of the change) and
   the body from a short summary of what the branch does - do not leave either
-  as a placeholder. Report the PR url. Then record the prediction against the
-  new PR number - a branch-mode review is the ideal case for this, because the
-  prediction provably predates every bot comment. Record only the findings fix
+  as a placeholder. Report the PR url. If an eligible pre-push receipt was
+  saved, publish it using `scripts/review-label.mjs` as described in
+  `references/reviewed-before-push.md`. This posts the commit/engine/depth/result
+  evidence and applies `reviewed-before-push` only to the matching live head.
+  If cleanup is not installed, omit the label and report the setup requirement;
+  do not undo the successful PR creation. For an existing PR found after a
+  branch-mode push, use the same helper and head check. Then record the prediction
+  against the created or existing PR number using the saved `PREDICTED_AT`;
+  scoring uses it to include bot comments triggered by the push or PR creation,
+  even if they arrive before the record step. Record only the findings fix
   mode did NOT apply (every row of the fixes table that is not `✅ applied`):
   an applied fix is gone from the code the bots read, so they cannot raise it,
   and recording it would sink precision for doing exactly what branch mode is
   for. Build `<scratchpad>/unfixed.json` (a bare array is fine) from the merged
   `findings.json` minus the findings fix mode applied; when fix mode did not
-  run or applied nothing, it is the whole merged set. Take
-  `PREDICTED_AT=$(date -u +%Y-%m-%dT%H:%M:%SZ)` just BEFORE `gh pr create`, so
-  a bot comment that lands before the record step still counts:
+  run or applied nothing, it is the whole merged set. Keep the timestamp captured
+  before the push; do not replace it at the record step:
 
   ```bash
   node ${SKILL_ROOT}/scripts/bot-precision.mjs record \
-    --repo "$repo_slug" --pr <NEW_PR_NUMBER> --predicted <scratchpad>/unfixed.json \
+    --repo "$repo_slug" --pr <PR_NUMBER> --predicted <scratchpad>/unfixed.json \
     --at "$PREDICTED_AT"
   ```
 
   The review is already saved locally; offer `--post` on the new PR number only if the user asks - findings that fix
   mode already applied must never be posted as review comments.
 - **Push only:** `git push -u origin "$local_branch"` and stop. Say in one line
-  that no PR was created.
+  that no PR was created. Keep any eligible pre-push receipt for publication
+  when a matching PR is later created; no PR means no label yet.
 - **No:** stop. Print the branch name and the review file path.
 
 **Unattended runs never ask and never create a PR** (see the operating contract

package/plugins/olko-github-pr/skills/lekker-review/references/reviewed-before-push.md

@@ -0,0 +1,94 @@
+# Reviewed before push
+
+`reviewed-before-push` records a completed local branch review of the current
+PR head. It is informational: it does not satisfy CI, required remote review,
+or the human-review marker for risky changes. The review comment records the
+full head/base SHAs, engine, depth, timestamp, and result. It is an attestation
+by the publishing user, not cryptographic proof that review preceded a push.
+
+## Install stale-label cleanup once per repository
+
+Copy `references/reviewed-before-push.yml` into the target repository as
+`.github/workflows/reviewed-before-push.yml` and land it on the default branch
+through that repository's normal review process. Do this before the local
+review whose receipt will be published. Do not add a workflow commit after
+review and then label that unreviewed commit.
+
+The workflow uses only GitHub API data, with no PR checkout. On new commits or
+receipt edits/deletion it removes the label unless a receipt from an owner,
+member, or collaborator matches the live head. Pagination includes all receipt
+comments. It does not add labels or replace merge gates. A newly reviewed head
+can be labeled again by the publisher. Cleanup is asynchronous; the label is
+not a merge-authorization signal. Workflows disabled by repository policy or
+Actions outages can delay removal.
+
+The helper refuses to publish if the cleanup workflow is absent. If setup is
+missing, keep the local review and PR creation successful, omit the label, and
+report the missing setup. Never silently install a write-capable workflow in
+another repository. A push-only run keeps the receipt locally until a PR exists.
+
+## Record before pushing
+
+Only in `MODE=branch`, after the review engine completed without degraded or
+missing required dimensions, settle every Critical/Important finding. Either
+fix it with verifier/test evidence or explicitly rebut it with a reason. Open
+observations may remain. A file containing only a review path or a SHA marker
+is not sufficient evidence.
+
+Save `<scratchpad>/pre-push-review.json` before the push:
+
+```json
+{
+  "version": 1,
+  "mode": "branch",
+  "result": "passed",
+  "headSha": "<full reviewed final local HEAD>",
+  "baseSha": "<full merge-base used by this review>",
+  "engine": "codex",
+  "depth": "medium",
+  "reviewedAt": "<UTC ISO timestamp when this review completed>",
+  "findings": [
+    {
+      "severity": "important",
+      "disposition": "fixed",
+      "evidence": "<actual fix verification and relevant test result>"
+    }
+  ]
+}
+```
+
+Use an empty `findings` array when the review found nothing. Otherwise include
+every finding in the merged review and lint set. Allowed dispositions are
+`fixed`, `rebutted`, and `open`; `open` is permitted only for observations and
+idiomatic suggestions. Rebuttals require specific evidence too. Set engine and
+depth to the values actually used. Keep the saved full review locally; finding
+text, evidence text, and local paths are not uploaded by the helper.
+
+`reviewedAt` must be a valid UTC ISO timestamp in `YYYY-MM-DDTHH:mm:ssZ`
+format, optionally with fractional seconds before `Z` (for example,
+`2026-10-29T09:00:00.123Z`). Date-only strings, timezone offsets, and invalid
+calendar dates are rejected by the publisher and cleanup workflow.
+
+After fixes, the receipt must describe the final SHA: fix verification and
+relevant tests must pass, and the only intervening edits must be those verified
+fixes. Any unrelated edit requires a fresh review. Never copy a receipt to a
+new SHA just to make the label apply.
+
+## Publish after pushing and creating or locating the PR
+
+Resolve the helper relative to the selected `SKILL.md` (same directory's
+`scripts/review-label.mjs`, including in Codex). Invoke with separate process
+arguments, or independently shell-quote each value:
+
+```bash
+node "<SKILL_ROOT>/scripts/review-label.mjs" \
+  --repo "<owner/repo>" --pr "<number>" \
+  --receipt "<scratchpad>/pre-push-review.json"
+```
+
+The helper checks the live open PR head, posts the receipt, creates the label
+if needed, and applies it. It checks the head before and after labeling, and
+removes the label if a concurrent push changed the head. Errors are failures
+to publish the label, not a failed local review. Do not claim the label was
+applied when the helper failed. Do not use this helper for a review performed
+in `MODE=pr` after pushing.

package/plugins/olko-github-pr/skills/lekker-review/references/reviewed-before-push.yml

@@ -0,0 +1,57 @@
+# Install this file on the target repository's default branch as
+# .github/workflows/reviewed-before-push.yml before publishing review labels.
+name: Reviewed before push
+on:
+  pull_request_target:
+    types: [opened, reopened, synchronize, edited, labeled]
+  issue_comment:
+    types: [created, edited, deleted]
+permissions:
+  contents: read
+  issues: write
+  pull-requests: read
+concurrency:
+  group: reviewed-before-push-${{ github.event.pull_request.number || github.event.issue.number }}
+  cancel-in-progress: false
+jobs:
+  reconcile:
+    if: github.event.pull_request || github.event.issue.pull_request
+    runs-on: ubuntu-latest
+    steps:
+      # No checkout: never execute code from the PR with this write token.
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const label = 'reviewed-before-push';
+            function isUtcTimestamp(value) {
+              const match = typeof value === 'string' && value.match(/^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2})(?:\.(\d+))?Z$/);
+              if (!match || match[0] !== value) return false;
+              const time = Date.parse(value);
+              const canonical = `${match[1]}.${(match[2] || '').padEnd(3, '0').slice(0, 3)}Z`;
+              return Number.isFinite(time) && new Date(time).toISOString() === canonical;
+            }
+            const { owner, repo } = context.repo;
+            const issue_number = context.payload.pull_request?.number || context.payload.issue.number;
+            const { data: pr } = await github.rest.pulls.get({ owner, repo, pull_number: issue_number });
+            if (!pr.labels.some(item => item.name === label)) return;
+            const comments = await github.paginate(github.rest.issues.listComments, { owner, repo, issue_number, per_page: 100 });
+            const valid = comments.some(comment => {
+              if (!['OWNER', 'MEMBER', 'COLLABORATOR'].includes(comment.author_association)) return false;
+              const match = comment.body?.match(/<!-- lekker:reviewed-before-push (\{[^\n]*\}) -->/);
+              if (!match) return false;
+              try {
+                const r = JSON.parse(match[1]);
+                return r.version === 1 && r.mode === 'branch' && r.result === 'passed'
+                  && r.headSha === pr.head.sha && /^[a-f0-9]{40}$/.test(r.baseSha)
+                  && ['workflow', 'codex', 'revmux'].includes(r.engine)
+                  && ['scan', 'medium', 'deep', 'deps'].includes(r.depth)
+                  && isUtcTimestamp(r.reviewedAt);
+              } catch { return false; }
+            });
+            if (!valid) {
+              try {
+                await github.rest.issues.removeLabel({ owner, repo, issue_number, name: label });
+              } catch (error) {
+                if (error.status !== 404) throw error;
+              }
+            }

package/plugins/olko-github-pr/skills/lekker-review/scripts/review-label.mjs

@@ -0,0 +1,90 @@
+#!/usr/bin/env node
+// Publish a local branch-review receipt using gh; PR-controlled values never enter shell source.
+import { execFileSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+
+export const LABEL = 'reviewed-before-push';
+export const PREFIX = '<!-- lekker:reviewed-before-push ';
+const SHA = /^[a-f0-9]{40}$/;
+
+function isUtcTimestamp(value) {
+  const match = typeof value === 'string' && value.match(/^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2})(?:\.(\d+))?Z$/);
+  if (!match || match[0] !== value) return false;
+  const time = Date.parse(value);
+  const canonical = `${match[1]}.${(match[2] || '').padEnd(3, '0').slice(0, 3)}Z`;
+  return Number.isFinite(time) && new Date(time).toISOString() === canonical;
+}
+
+export function validateReceipt(receipt) {
+  if (receipt?.version !== 1 || receipt.mode !== 'branch' || receipt.result !== 'passed'
+      || !SHA.test(receipt.headSha) || !SHA.test(receipt.baseSha)
+      || !['workflow', 'codex', 'revmux'].includes(receipt.engine)
+      || !['scan', 'medium', 'deep', 'deps'].includes(receipt.depth)
+      || !isUtcTimestamp(receipt.reviewedAt)
+      || !Array.isArray(receipt.findings)) {
+    throw new Error('Invalid branch-review receipt');
+  }
+  for (const finding of receipt.findings) {
+    if (!['critical', 'important', 'observation', 'idiomatic'].includes(finding.severity)
+        || !['fixed', 'rebutted', 'open'].includes(finding.disposition)
+        || (['critical', 'important'].includes(finding.severity) && finding.disposition === 'open')
+        || (['fixed', 'rebutted'].includes(finding.disposition) && !finding.evidence?.trim())) {
+      throw new Error('Findings require dispositions and evidence; no open Critical/Important finding is allowed');
+    }
+  }
+  return receipt;
+}
+
+export function reviewComment(receipt) {
+  validateReceipt(receipt);
+  // Only publish the attestation, not local paths or potentially sensitive finding text.
+  const { version, mode, result, headSha, baseSha, engine, depth, reviewedAt } = receipt;
+  const attestation = { version, mode, result, headSha, baseSha, engine, depth, reviewedAt };
+  return `Reviewed before push\n\nCommit: \`${headSha}\`\nBase: \`${baseSha}\`\nEngine: ${engine}\nDepth: ${depth}\nReviewed at: ${reviewedAt}\nResult: passed; no unresolved Critical/Important findings.\n\nThis records a local review; required CI and remote review gates still apply.\n\n${PREFIX}${JSON.stringify(attestation)} -->`;
+}
+
+export function publishReview({ repo, pr, receipt }, run = execFileSync) {
+  if (!/^[\w.-]+\/[\w.-]+$/.test(repo) || !/^[1-9]\d*$/.test(String(pr))) {
+    throw new Error('Expected --repo owner/repo and a positive --pr number');
+  }
+  const body = reviewComment(receipt);
+  const gh = (args, input) => run('gh', args, { encoding: 'utf8', input });
+  const readHead = () => JSON.parse(gh(['pr', 'view', String(pr), '--repo', repo, '--json', 'headRefOid,state']));
+  const ensureCurrent = () => {
+    const current = readHead();
+    if (current.state !== 'OPEN' || current.headRefOid !== receipt.headSha) {
+      throw new Error('PR is closed or its head differs from the reviewed commit; label withheld');
+    }
+  };
+  ensureCurrent();
+  // The installation is explicit: do not silently add a privileged workflow to someone else's repo.
+  gh(['api', `repos/${repo}/contents/.github/workflows/reviewed-before-push.yml`]);
+  gh(['api', '--method', 'POST', `repos/${repo}/issues/${pr}/comments`, '--input', '-'], JSON.stringify({ body }));
+  gh(['label', 'create', LABEL, '--repo', repo, '--color', '0E8A16', '--description', 'Local review completed for the current PR head before push', '--force']);
+  ensureCurrent();
+  gh(['pr', 'edit', String(pr), '--repo', repo, '--add-label', LABEL]);
+  // Catch a concurrent push after adding the label. The workflow also reconciles later pushes.
+  try {
+    ensureCurrent();
+  } catch (error) {
+    gh(['pr', 'edit', String(pr), '--repo', repo, '--remove-label', LABEL]);
+    throw error;
+  }
+  return { label: LABEL, headSha: receipt.headSha };
+}
+
+function main(argv) {
+  const options = {};
+  for (let i = 0; i < argv.length; i += 2) {
+    if (!['--repo', '--pr', '--receipt'].includes(argv[i]) || !argv[i + 1] || options[argv[i]]) {
+      throw new Error('Usage: review-label.mjs --repo owner/repo --pr N --receipt receipt.json');
+    }
+    options[argv[i]] = argv[i + 1];
+  }
+  if (!options['--receipt']) throw new Error('--receipt is required');
+  const receipt = JSON.parse(readFileSync(options['--receipt'], 'utf8'));
+  console.log(JSON.stringify(publishReview({ repo: options['--repo'], pr: options['--pr'], receipt })));
+}
+
+if (process.argv[1] === fileURLToPath(import.meta.url)) main(process.argv.slice(2));

package/plugins/olko-obsidian/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-obsidian",
   "description": "Keep an Obsidian vault in sync with work: PR sync, task rollover, morning routine.",
-  "version": "1.67.0",
+  "version": "1.68.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-product/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-product",
   "description": "Take a product idea to a shippable build: MVP passes, full-stack scaffolds, UX/UI quality loops, launch plans.",
-  "version": "1.67.0",
+  "version": "1.68.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-reflection/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-reflection",
   "description": "Look back and improve: self-critique, retrospectives, performance review, rapid learning.",
-  "version": "1.67.0",
+  "version": "1.68.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-release/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-release",
   "description": "Ship a release: semantic-release setup, changelogs, store listing copy, release-day routine.",
-  "version": "1.67.0",
+  "version": "1.68.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-skill-meta/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-skill-meta",
   "description": "Author and maintain agent skills and the AI toolchain itself.",
-  "version": "1.67.0",
+  "version": "1.68.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-web-ops/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-web-ops",
   "description": "Operate a website: WAF rules, search console audits, analytics bootstrap, docs indexes.",
-  "version": "1.67.0",
+  "version": "1.68.0",
   "author": {
     "name": "Oleg Koval"
   },