@olegkoval/agent-skills 1.70.0 → 1.71.1

package/adapters/claude/olko-github-pr/skills/lekker-review/scripts/setup-worktree.sh

@@ -134,6 +134,20 @@ collect_project_rules() {
         -not -path '*/node_modules/*' 2>/dev/null | sort)
 }
 
+# Hard rules must come from a tree the PR author does not control: a PR that
+# deletes a rule and then breaks it would otherwise leave nothing to enforce.
+collect_project_rules_at_ref() {
+    local repo="$1" ref="$2" dir status=0
+    dir="$(mktemp -d "/tmp/lekker-base-rules-XXXXXX")"
+    if git -C "$repo" archive "$ref" 2>/dev/null | tar -x -C "$dir" 2>/dev/null; then
+        collect_project_rules "$dir"
+    else
+        status=1
+    fi
+    rm -rf "$dir"
+    return "$status"
+}
+
 # Scan depth needs PR-authored review guidance but skips expensive worktree
 # setup. Read the PR tree from an archive so no Git worktree or checkout is made.
 if [[ "${LEKKER_RULES_ONLY:-}" == "1" ]]; then
@@ -143,20 +157,57 @@ if [[ "${LEKKER_RULES_ONLY:-}" == "1" ]]; then
         if git -C "$REPO_ROOT" fetch origin "+refs/heads/${PR_BRANCH}:refs/remotes/origin/${PR_BRANCH}" 2>/dev/null; then
             RULES_REF="origin/$PR_BRANCH"
         elif git -C "$REPO_ROOT" fetch origin "$PR_BRANCH" 2>/dev/null; then
-            RULES_REF=FETCH_HEAD
+            # The base fetch below overwrites FETCH_HEAD, so pin the PR tip now.
+            RULES_REF="$(git -C "$REPO_ROOT" rev-parse FETCH_HEAD)"
         else
             printf 'ERROR: could not fetch PR branch %s for rules-only scan\n' "$PR_BRANCH" >&2
             exit 1
         fi
     fi
+    # Base rules are best effort: a failure here keeps projectRules and nulls baseProjectRules,
+    # because the base copy only hardens validation and must not abort the scan.
+    RULES_BASE_SHA=""
+    if [[ -n "${LEKKER_BASE_REF:-}" ]]; then
+        BASE_FETCH_OK=1
+        if [[ -z "$LOCAL_REPO" && "$LEKKER_BASE_REF" == origin/* ]]; then
+            BASE_BRANCH="${LEKKER_BASE_REF#origin/}"
+            git -C "$REPO_ROOT" fetch origin \
+                "+refs/heads/${BASE_BRANCH}:refs/remotes/origin/${BASE_BRANCH}" 2>/dev/null || BASE_FETCH_OK=0
+        fi
+        # Fork point, as in full mode: the base tip may carry rules added after the PR branched.
+        if [[ "$BASE_FETCH_OK" == "1" ]] \
+            && git -C "$REPO_ROOT" rev-parse --verify -q "${LEKKER_BASE_REF}^{commit}" >/dev/null; then
+            RULES_BASE_SHA="$(git -C "$REPO_ROOT" merge-base "$LEKKER_BASE_REF" "$RULES_REF" 2>/dev/null || true)"
+            # A fork older than the shallow clone depth has no common ancestor until history is deepened.
+            if [[ -z "$RULES_BASE_SHA" ]] \
+                && [[ "$(git -C "$REPO_ROOT" rev-parse --is-shallow-repository 2>/dev/null)" == "true" ]]; then
+                git -C "$REPO_ROOT" fetch -q --deepen=200 origin 2>/dev/null || true
+                RULES_BASE_SHA="$(git -C "$REPO_ROOT" merge-base "$LEKKER_BASE_REF" "$RULES_REF" 2>/dev/null || true)"
+            fi
+        fi
+    fi
     RULES_SOURCE="/tmp/lekker-rules-source-$$"
     mkdir -p "$RULES_SOURCE"
     git -C "$REPO_ROOT" archive "$RULES_REF" | tar -x -C "$RULES_SOURCE"
     PROJECT_RULES="$(collect_project_rules "$RULES_SOURCE")"
-    python3 - "$OUT_JSON" "$PROJECT_RULES" <<'PYEOF'
+    BASE_PROJECT_RULES=""
+    HAVE_BASE_RULES=0
+    if [[ -n "${LEKKER_BASE_REF:-}" ]]; then
+        if [[ -n "$RULES_BASE_SHA" ]] \
+            && BASE_PROJECT_RULES="$(collect_project_rules_at_ref "$REPO_ROOT" "$RULES_BASE_SHA")"; then
+            HAVE_BASE_RULES=1
+        else
+            BASE_PROJECT_RULES=""
+            NOTES="${NOTES}base-rules-unavailable;"
+        fi
+    fi
+    python3 - "$OUT_JSON" "$PROJECT_RULES" "$BASE_PROJECT_RULES" "$HAVE_BASE_RULES" "$NOTES" <<'PYEOF'
 import json, sys
+out = {"projectRules": sys.argv[2]}
+out["baseProjectRules"] = sys.argv[3] if sys.argv[4] == "1" else None
+out["notes"] = sys.argv[5]
 with open(sys.argv[1], "w") as f:
-    json.dump({"projectRules": sys.argv[2]}, f, indent=2)
+    json.dump(out, f, indent=2)
 PYEOF
     rm -rf "$RULES_SOURCE"
     printf 'OK %s\n' "$OUT_JSON"
@@ -475,6 +526,20 @@ PROJECT_RULES_FILE="/tmp/lekker-rules-$$.txt"
 printf '' > "$PROJECT_RULES_FILE"
 collect_project_rules "$WORKTREE_PATH" > "$PROJECT_RULES_FILE"
 
+BASE_RULES_FILE="/tmp/lekker-base-rules-$$.txt"
+BASE_RULES_STATE="absent"
+printf '' > "$BASE_RULES_FILE"
+if [[ -n "$MERGE_BASE_NOTE" && "$MERGE_BASE_NOTE" != "unknown" ]] \
+    && git -C "$REPO_ROOT" rev-parse --verify -q "${MERGE_BASE_NOTE}^{commit}" >/dev/null; then
+    if collect_project_rules_at_ref "$REPO_ROOT" "$MERGE_BASE_NOTE" > "$BASE_RULES_FILE"; then
+        BASE_RULES_STATE="present"
+    else
+        NOTES="${NOTES}base-rules-unavailable;"
+    fi
+else
+    NOTES="${NOTES}base-rules-unavailable;"
+fi
+
 # ---------------------------------------------------------------------------
 # 6. HEAD SHA
 # ---------------------------------------------------------------------------
@@ -518,14 +583,17 @@ python3 - \
     "$DEPS_INSTALL_FILE" \
     "$ESLINT_JSON_FILE" \
     "$TEST_RUNNER_JSON" \
-    "$OUT_JSON" <<'PYEOF'
+    "$OUT_JSON" \
+    "$BASE_RULES_FILE" \
+    "$BASE_RULES_STATE" <<'PYEOF'
 import json, sys, os
 
 (worktree_path, repo_root, head_sha, head_sha_short,
  tsc_file, eslint_file, rules_file, delta_file, notes,
  changed_files_file, base_ref_val, eslint_scope_file,
  tsc_changed_file, tsc_count_file, merge_base_val,
- deps_install_file, eslint_json_file, test_runner_json, out_json) = sys.argv[1:20]
+ deps_install_file, eslint_json_file, test_runner_json, out_json,
+ base_rules_file, base_rules_state) = sys.argv[1:22]
 
 def parse_runner(raw):
     try:
@@ -581,6 +649,7 @@ data = {
     "tscTail":        read_file(tsc_file),
     "eslintTail":     read_file(eslint_file),
     "projectRules":   read_file(rules_file),
+    "baseProjectRules": read_file(base_rules_file) if base_rules_state == "present" else None,
     "deltaFile":      None if delta_file == "null" else delta_file,
     "notes":          notes,
     "changedFiles":   changed_files,
@@ -598,7 +667,7 @@ data = {
     "eslintJson":     eslint_json_file if file_has_content(eslint_json_file) else None,
 }
 
-for p in (tsc_file, eslint_file, rules_file, changed_files_file,
+for p in (tsc_file, eslint_file, rules_file, base_rules_file, changed_files_file,
           eslint_scope_file, tsc_changed_file, tsc_count_file,
           deps_install_file):
     try:

package/adapters/claude/olko-github-pr/skills/lekker-review/scripts/validate-lines.mjs

@@ -75,6 +75,8 @@ export function loadDedup(workflowPath = join(SKILL, 'workflow.js')) {
     liftConst('HARD_RULES', 'const HARD_RULES = new Set()'),
     liftConst('SAME_ISSUE_LINE_WINDOW', 'const SAME_ISSUE_LINE_WINDOW = 30'),
     liftConst('SEVERITY_RANK', 'const SEVERITY_RANK = { critical: 3, important: 2, observation: 1, idiomatic: 0 }'),
+    // Absent from an older workflow.js, whose sameIssue does not call it.
+    (() => { try { return lift('normalizeRuleQuote') } catch { return '' } })(),
     ...['titleTokens', 'sameIssue', 'nearbyLines', 'spanWithinWindow',
         'isHardRule', 'longest', 'mergeFindings', 'dedup'].map(lift),
   ].join('\n')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@olegkoval/agent-skills",
-  "version": "1.70.0",
+  "version": "1.71.1",
   "private": false,
   "publishConfig": {
     "access": "public"

package/plugins/olko-apple-kit/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-apple-kit",
   "description": "Build and ship Apple platform apps: macOS menubar apps, App Store submissions.",
-  "version": "1.70.0",
+  "version": "1.71.1",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-creative/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-creative",
   "description": "Creative and personal projects: photo galleries, music players, listings, wiki editing.",
-  "version": "1.70.0",
+  "version": "1.71.1",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-garmin-kit/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-garmin-kit",
   "description": "Build, test and publish Garmin Connect IQ watch faces.",
-  "version": "1.70.0",
+  "version": "1.71.1",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-git-tools/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-git-tools",
   "description": "Everyday git and GitHub CLI operations: conventional commits, branch hygiene.",
-  "version": "1.70.0",
+  "version": "1.71.1",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-github-pr/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-github-pr",
   "description": "Drive GitHub pull requests to merge-ready: review-bot loops, CI fixes, descriptions, dependency triage.",
-  "version": "1.70.0",
+  "version": "1.71.1",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-github-pr/skills/lekker-review/SKILL.md

@@ -469,12 +469,13 @@ Fire both tracks in the same turn.
 At scan depth, collect review guidance without creating a worktree:
 
 ```bash
-LEKKER_RULES_ONLY=1 ${SKILL_ROOT}/scripts/setup-worktree.sh \
+LEKKER_RULES_ONLY=1 LEKKER_BASE_REF=origin/<BASE_BRANCH> \
+  ${SKILL_ROOT}/scripts/setup-worktree.sh \
   <REPO_SLUG> <PR_BRANCH> <scratchpad>/rules.json
 ```
 
 Read `projectRules` from `rules.json` into `context.json`. This archive-only
-mode reads the PR tree and does not run static checks.
+mode fetches the PR base and reads `baseProjectRules` at the merge base with the PR branch (as full mode does), not at the base tip. If the base cannot be fetched, resolved or merge-based, `baseProjectRules` is `null` and `notes` carries `base-rules-unavailable`; the scan still succeeds. It does not run static checks.
 
 Run via Bash with `run_in_background`:
 
@@ -686,6 +687,7 @@ Write `<scratchpad>/context.json` with keys:
 {
   "acList":          "<numbered ACs from your issue tracker, or empty>",
   "projectRules":    "<worktree.json or rules.json projectRules + any recalled review patterns appended under '## Recalled patterns'>",
+  "baseProjectRules": "<worktree.json or rules.json baseProjectRules, copied unchanged (no recalled patterns); null when absent>",
   "changedPaths":    "<PR files[].path list, or an exact matching worktree.json changedFiles list>",
   "sentrySignals":   "<monitoring issue summaries, or null>",
   "ciStatus":        "<passing | failing: <names> | pending | N/A>",
@@ -914,6 +916,13 @@ value first). `REVIEW.md` ignore rules never suppress findings in changed paths.
 applies exclusions to agent and lint findings using `changedPaths`; if paths are
 unavailable, keep findings. It never switches off a hard rule from `CLAUDE.md` or the house rules.
 
+**Project rules are hard rules.** A prohibition or obligation in `projectRules`
+(NEVER, MUST, ALWAYS, DO NOT or plain-English equivalent) that a changed line
+violates is raised as Critical with `rule: "PROJECT:<slug>"` and a verbatim
+`ruleQuote`. The verifier runs `scripts/project-rule-findings.mjs`, which drops
+a finding whose quote is not found in `projectRules`; otherwise it takes the
+hard-rule path (anchor and applicability, no runtime challenges).
+
 **Approval standard.** The verdict answers "does this definitely improve the
 codebase's health", not "is this how I would have written it". Perfect code does
 not exist. `✅ LGTM - ship it` is the right call for a change that improves

package/plugins/olko-github-pr/skills/lekker-review/references/agents/conventions.md

@@ -127,6 +127,9 @@ Use it as a prior, not as a checklist:
 EXISTING_REVIEWS: read key "existingReviews" from CONTEXT_FILE (awareness only, skip findings already raised)
 
 PROJECT_RULES to verify: read key "projectRules" from CONTEXT_FILE.
+A changed line that violates a prohibition or obligation in PROJECT_RULES is a Critical
+finding tagged `rule: "PROJECT:<slug>"` with `ruleQuote` set to the exact rule sentence
+(see PROJECT RULES AS HARD RULES in the task message).
 
 Diff: read the full unified PR diff from the file DIFF_FILE (absolute path given in your task message). Do NOT run gh pr diff.
 Worktree: WORKTREE_PATH is given in your task message (null in scan mode, diff only).

package/plugins/olko-github-pr/skills/lekker-review/references/agents/implementation.md

@@ -105,6 +105,9 @@ SENTRY_SIGNALS: read key "sentrySignals" from CONTEXT_FILE.
 EXISTING_REVIEWS: read key "existingReviews" from CONTEXT_FILE (awareness only, skip findings already raised)
 
 PROJECT_RULES to verify: read key "projectRules" from CONTEXT_FILE.
+A changed line that violates a prohibition or obligation in PROJECT_RULES is a Critical
+finding tagged `rule: "PROJECT:<slug>"` with `ruleQuote` set to the exact rule sentence
+(see PROJECT RULES AS HARD RULES in the task message).
 
 Diff: read the full unified PR diff from the file DIFF_FILE (absolute path given in your task message). Do NOT run gh pr diff.
 Worktree: WORKTREE_PATH is given in your task message (null in scan mode, diff only).

package/plugins/olko-github-pr/skills/lekker-review/references/agents/quality.md

@@ -72,6 +72,9 @@ Note: awareness only. Do not anchor on prior reviews. Skip findings already
 raised at the same file:line by another reviewer.
 
 PROJECT_RULES to verify: read key "projectRules" from CONTEXT_FILE.
+A changed line that violates a prohibition or obligation in PROJECT_RULES is a Critical
+finding tagged `rule: "PROJECT:<slug>"` with `ruleQuote` set to the exact rule sentence
+(see PROJECT RULES AS HARD RULES in the task message).
 
 Diff: read the full unified PR diff from the file DIFF_FILE (absolute path given in your task message). Do NOT run gh pr diff.
 Worktree: WORKTREE_PATH is given in your task message (null in scan mode, diff only).

package/plugins/olko-github-pr/skills/lekker-review/references/agents/simplification.md

@@ -56,6 +56,9 @@ actionable: name the move or drop the finding.
 EXISTING_REVIEWS: read key "existingReviews" from CONTEXT_FILE (awareness only, skip findings already raised)
 
 PROJECT_RULES to verify: read key "projectRules" from CONTEXT_FILE.
+A changed line that violates a prohibition or obligation in PROJECT_RULES is a Critical
+finding tagged `rule: "PROJECT:<slug>"` with `ruleQuote` set to the exact rule sentence
+(see PROJECT RULES AS HARD RULES in the task message).
 
 Diff: read the full unified PR diff from the file DIFF_FILE (absolute path given in your task message). Do NOT run gh pr diff.
 Worktree: WORKTREE_PATH is given in your task message (null in scan mode, diff only).

package/plugins/olko-github-pr/skills/lekker-review/references/agents/test-quality.md

@@ -169,6 +169,9 @@ Return the review summary through these structured fields in addition to
 EXISTING_REVIEWS: read key "existingReviews" from CONTEXT_FILE (awareness only, skip findings already raised)
 
 PROJECT_RULES to verify: read key "projectRules" from CONTEXT_FILE.
+A changed line that violates a prohibition or obligation in PROJECT_RULES is a Critical
+finding tagged `rule: "PROJECT:<slug>"` with `ruleQuote` set to the exact rule sentence
+(see PROJECT RULES AS HARD RULES in the task message).
 Diff: read DIFF_FILE. List every test file/spec
 Worktree: WORKTREE_PATH is given in your task message (null in scan mode, diff only).
 

package/plugins/olko-github-pr/skills/lekker-review/references/agents/verifier.md

@@ -28,14 +28,34 @@ unless Step 0 validates it through the house hard-rule path.
 
 ## Step 0 -- Hard-rule validation (check this FIRST)
 
-If the FINDING JSON has any non-empty `rule` field, including built-in tags
-such as `TS-1`, `TS-2`, `GQL-1`, or `PR-1`, do NOT run the five adversarial
+If the FINDING JSON has any non-empty `rule` field, do NOT run the five adversarial
 challenges below. They ask
 runtime-failure questions that a standards violation can never answer, and
 answering them honestly would drop a finding that house-rules policy declares
 Critical on standards grounds rather than on runtime behaviour.
 
-Instead run exactly two checks:
+For `rule: "weakens-project-rule"`, use this dedicated path:
+
+1. **Removed-line anchor**: confirm the quoted rule appears on a `-` line in
+   `DIFF_FILE` for the finding's file. Ignore `---` file headers. This anchor is
+   valid for both a deletion and a replacement; do not require a matching `+`
+   line or downgrade the finding because it has no production-code `+` line.
+2. **Base-rule validation**: write the FINDING JSON to a unique temp file and run
+   `node <this prompt's directory>/../../scripts/project-rule-findings.mjs <finding.json> <CONTEXT_FILE>`.
+   The validator requires the exact quote to exist in `baseProjectRules`; a
+   missing base copy or rejected quote fails this check. Do not validate against
+   `projectRules`, which may already reflect the PR's weakened rules. The validator also
+   rejects a rule line that is still present unchanged in `projectRules` (the rule line was neither removed nor changed).
+   Exit 1 means `dropped`. Exit 2 means the validator could not run (for example
+   `baseProjectRules` is missing): check by hand that the exact quote appears in
+   `baseProjectRules` ONLY, never in `projectRules`; if `baseProjectRules` is not a string
+   or the quote is absent there, `dropped`. Otherwise keep the finding, say in `reasoning`
+   that the validator was unavailable, and set `validatorUnavailable: true`.
+
+Both checks pass -> `confirmed` at the finding's Important severity. Either
+check fails -> `dropped`. Do not downgrade a confirmed weakening.
+
+For all other non-empty `rule` tags, run exactly two checks:
 
 1. **Anchor**: the flagged code genuinely appears on a `+` line of
    `DIFF_FILE` (for PR-1, the PR title genuinely lacks a ticket present in
@@ -55,6 +75,17 @@ the rule and quoting the violating snippet. Either check fails -> `dropped`,
 with `reasoning` naming which check failed. There is no `downgraded` outcome
 for a hard rule: it either violates the rule or it does not.
 
+For a `rule` starting with `PROJECT:`, the rule text lives in `baseProjectRules` of
+`CONTEXT_FILE` when that key is a string (the base branch's copy, which the PR cannot
+edit), otherwise in `projectRules`, not in `HOUSE_RULES_FILE`. Write the FINDING JSON to a unique temp file
+(create it with `mktemp`, never a fixed name, because verifiers run in parallel) and run `node <this prompt's directory>/../../scripts/project-rule-findings.mjs <finding.json> <CONTEXT_FILE>`.
+Exit 1 means the quoted rule is not in `projectRules` (or the tag is malformed):
+`dropped`, with that output as `reasoning`. Any other non-zero exit means the validator
+could not run: read that same key yourself and confirm the exact quoted sentence is in it.
+If it is not, `dropped`. If it is, keep the finding at its severity, say in `reasoning` that
+the validator was unavailable, set `validatorUnavailable: true`, and judge applicability as below. On exit 0, judge applicability
+against the quoted rule as the second check.
+
 Then **stop** -- do not continue to Step 1 or the five challenges.
 
 ---

package/plugins/olko-github-pr/skills/lekker-review/scripts/fixtures/project-rules/CLAUDE.md

@@ -0,0 +1,4 @@
+# Fixture rules
+
+- NEVER call console.log in src/.
+- NEVER mutate function arguments.

package/plugins/olko-github-pr/skills/lekker-review/scripts/fixtures/project-rules/planted.diff

@@ -0,0 +1,9 @@
+diff --git a/src/total.js b/src/total.js
+--- a/src/total.js
++++ b/src/total.js
+@@ -1,3 +1,6 @@
++export function addItem(list, item) {
++  console.log('adding', item)
++  list.push(item)
++  return list
++}

package/plugins/olko-github-pr/skills/lekker-review/scripts/project-rule-findings.mjs

@@ -0,0 +1,167 @@
+#!/usr/bin/env node
+// Validates findings tagged `rule: "PROJECT:<slug>"`.
+//
+// A project's own prohibitions and obligations (CLAUDE.md, AGENTS.md, REVIEW.md)
+// are collected into `projectRules`. A lens that raises one as a hard rule must
+// quote the rule it enforces. A quote that is not in `projectRules` means the
+// model invented the rule, so the finding is rejected instead of being allowed
+// to ride the hard-rule path past the runtime challenges.
+//
+//   node project-rule-findings.mjs <finding.json> <context.json>
+//
+// Exit 0 when valid or when the finding is not a PROJECT rule, 1 when rejected,
+// 2 when the validator itself could not run (usage error, unreadable or malformed input).
+import { readFileSync, realpathSync } from 'node:fs'
+import { fileURLToPath } from 'node:url'
+
+const TAG_PATTERN = /^PROJECT:[a-z0-9]+(-[a-z0-9]+)*$/
+const MIN_QUOTE_LENGTH = 12
+
+export function isProjectRuleTag(tag) {
+  return typeof tag === 'string' && TAG_PATTERN.test(tag)
+}
+
+// Case, runs of whitespace and markdown emphasis or list markers vary between a
+// rules file and a model's copy of it; the words must not.
+export function normalizeQuote(text) {
+  return String(text ?? '')
+    .replace(/(^|\n)\s{0,3}#{1,6}\s+/g, '$1')
+    .replace(/(^|\n)\s{0,3}>\s?/g, '$1')
+    .replace(/`([^`\n]+)`/g, '$1')
+    .replace(/(^|[\s([{])(\*{1,2}|_{1,2})(\S(?:.*?\S)?)\2(?=$|[\s.,;:!?)}\]])/g, '$1$3')
+    .replace(/^\s*[-+]\s+/gm, ' ')
+    .replace(/\s+/g, ' ')
+    .trim()
+    .toLowerCase()
+}
+
+const RECALLED_PATTERNS_HEADING = /^\s{0,3}#{1,6}\s+recalled patterns\s*$/gim
+
+// Recalled patterns are memory, not the project's rules, so nothing below the last such heading is a valid quote source.
+// SKILL.md appends that heading at the end; an earlier one inside a rules file must not drop the rules after it.
+export function stripRecalledPatterns(text) {
+  const source = String(text ?? '')
+  const last = [...source.matchAll(RECALLED_PATTERNS_HEADING)].at(-1)
+  return last ? source.slice(0, last.index) : source
+}
+
+export function quoteAppearsIn(quote, projectRules) {
+  const needle = normalizeQuote(quote)
+  if (!needle) return false
+  const rules = stripRecalledPatterns(projectRules)
+  if (needle.length >= MIN_QUOTE_LENGTH && normalizeQuote(rules).includes(needle)) return true
+  return rules.split(/\r?\n/).some(line => normalizeQuote(line) === needle)
+}
+
+export function validateProjectRuleFinding(finding, projectRules) {
+  const tag = finding?.rule
+  if (typeof tag !== 'string' || !tag.startsWith('PROJECT:')) {
+    return { ok: true, reason: 'not a PROJECT rule' }
+  }
+  if (!isProjectRuleTag(tag)) {
+    return { ok: false, reason: `malformed tag "${tag}": expected PROJECT:<kebab-case-slug>` }
+  }
+  if (typeof finding.ruleQuote !== 'string' || finding.ruleQuote.trim() === '') {
+    return { ok: false, reason: 'missing ruleQuote: quote the project rule verbatim' }
+  }
+  if (!quoteAppearsIn(finding.ruleQuote, projectRules)) {
+    return { ok: false, reason: 'ruleQuote not found in projectRules' }
+  }
+  return { ok: true, reason: 'quote found in projectRules' }
+}
+
+// Still present means the whole rule block is unchanged; any wording change in the block
+// counts as possibly weakened and is left to the verifier.
+const LIST_MARKER = /^\s*([-+*]|\d+[.)])\s+/
+
+const indentOf = line => line.length - line.trimStart().length
+
+// A deeper marker or indented text belongs to its parent bullet, even after a blank line (loose list),
+// so an exception there must change the parent block.
+const isHeading = line => /^\s{0,3}#{1,6}\s/.test(line)
+const isListItem = line => LIST_MARKER.test(line)
+
+function startsNewBlock(line, current) {
+  if (isHeading(line)) return true
+  const [first] = current
+  if (first === undefined) return true
+  if (current[current.length - 1] === '') return !(isListItem(first) && indentOf(line) > indentOf(first))
+  if (!isListItem(line)) return false
+  if (isListItem(first)) return indentOf(line) <= indentOf(first)
+  return true
+}
+
+function ruleBlocks(text) {
+  const groups = stripRecalledPatterns(text).split(/\r?\n/).reduce((acc, line) => {
+    const current = acc[acc.length - 1]
+    if (line.trim() === '') return current === undefined || current.length === 0 ? acc : [...acc.slice(0, -1), [...current, '']]
+    if (current === undefined || startsNewBlock(line, current)) return [...acc, [line]]
+    return [...acc.slice(0, -1), [...current, line]]
+  }, [])
+  return groups
+    .map(lines => lines.map((line, i) => normalizeQuote(i === 0 ? line.replace(LIST_MARKER, '') : line)).filter(line => line !== '').join(' '))
+    .filter(block => block !== '')
+}
+
+export function ruleLineStillPresent(quote, baseProjectRules, projectRules) {
+  const needle = normalizeQuote(quote)
+  const baseHits = needle ? ruleBlocks(baseProjectRules).filter(block => block.includes(needle)) : []
+  if (baseHits.length === 0) return false
+  const prBlocks = new Set(ruleBlocks(projectRules))
+  return baseHits.some(block => prBlocks.has(block))
+}
+
+// `unavailable` marks a missing input, not a judgement on the finding: the CLI maps it to exit 2.
+export function validateWeakenedProjectRuleFinding(finding, baseProjectRules, projectRules) {
+  if (finding?.rule !== 'weakens-project-rule') {
+    return { ok: true, reason: 'not a weakened project rule' }
+  }
+  if (typeof baseProjectRules !== 'string') {
+    return { ok: false, unavailable: true, reason: 'baseProjectRules unavailable' }
+  }
+  if (typeof finding.ruleQuote !== 'string' || finding.ruleQuote.trim() === '') {
+    return { ok: false, reason: 'missing ruleQuote: quote the removed project rule' }
+  }
+  if (!quoteAppearsIn(finding.ruleQuote, baseProjectRules)) {
+    return { ok: false, reason: 'ruleQuote not found in baseProjectRules' }
+  }
+  if (typeof projectRules === 'string' && ruleLineStillPresent(finding.ruleQuote, baseProjectRules, projectRules)) {
+    return { ok: false, reason: 'rule still present in projectRules' }
+  }
+  return { ok: true, reason: 'quote found in baseProjectRules' }
+}
+
+function main(argv) {
+  const [findingPath, contextPath] = argv
+  if (!findingPath || !contextPath) {
+    console.error('usage: project-rule-findings.mjs <finding.json> <context.json>')
+    return 2
+  }
+  try {
+    const finding = JSON.parse(readFileSync(findingPath, 'utf8'))
+    const context = JSON.parse(readFileSync(contextPath, 'utf8'))
+    if (finding?.rule === 'weakens-project-rule') {
+      const result = validateWeakenedProjectRuleFinding(finding, context.baseProjectRules, context.projectRules)
+      console.log(JSON.stringify(result))
+      if (result.unavailable) return 2
+      return result.ok ? 0 : 1
+    }
+    // Base-branch rules are authoritative; PR-tree rules only when no base was resolved.
+    const authoritative = typeof context.baseProjectRules === 'string' ? context.baseProjectRules : context.projectRules
+    const result = validateProjectRuleFinding(finding, authoritative)
+    console.log(JSON.stringify(result))
+    return result.ok ? 0 : 1
+  } catch (error) {
+    // Exit 1 is reserved for "rejected"; a tooling failure must not read as one.
+    console.error(`project-rule-findings: unavailable: ${error.message}`)
+    return 2
+  }
+}
+
+function isMain() {
+  try { return realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url)) } catch { return false }
+}
+
+if (isMain()) {
+  process.exit(main(process.argv.slice(2)))
+}