@olegkoval/agent-skills 1.70.0 → 1.71.1

package/plugins/olko-github-pr/skills/lekker-review/scripts/selftest.mjs

@@ -52,11 +52,13 @@ const preamble = [
   "const SEVERITY_RANK = { observation: 0, idiomatic: 1, important: 2, critical: 3 }",
   // hardRuleCorroborated is likewise gone from the current file and kept in this
   // list for the same reason: an older workflow.js calls it from isHardRule.
-  ...['titleTokens', 'sameIssue', 'nearbyLines', 'spanWithinWindow', 'hardRuleCorroborated',
+  ...['titleTokens', 'normalizeRuleQuote', 'weakenedRuleSeverity', 'sameIssue', 'nearbyLines', 'spanWithinWindow', 'hardRuleCorroborated',
       'isHardRule', 'longest', 'mergeFindings', 'dedup', 'shouldVerify', 'isProveAttempt', 'countProveAttempt'].map(n => {
         // countProveAttempt is called directly by the checks, so its stub returns NaN and the
         // checks FAIL with a diff instead of the run crashing on an older workflow.js.
         try { return lift(n) } catch {
+          if (n === 'normalizeRuleQuote') return "function normalizeRuleQuote() { return 'absent from this workflow.js' }"
+          if (n === 'weakenedRuleSeverity') return "function weakenedRuleSeverity() { return 'absent from this workflow.js' }"
           return n === 'countProveAttempt'
             ? 'function countProveAttempt() { return NaN }'
             : `function ${n}() { throw new Error('${n} absent from this workflow.js') }`
@@ -64,8 +66,8 @@ const preamble = [
       }),
 ].join('\n')
 
-const { dedup, isHardRule, shouldVerify, sameIssue, isProveAttempt, countProveAttempt } =
-  new Function(preamble + '\nreturn { dedup, isHardRule, shouldVerify, sameIssue, isProveAttempt, countProveAttempt }')()
+const { dedup, isHardRule, shouldVerify, sameIssue, isProveAttempt, countProveAttempt, normalizeRuleQuote, weakenedRuleSeverity } =
+  new Function(preamble + '\nreturn { dedup, isHardRule, shouldVerify, sameIssue, isProveAttempt, countProveAttempt, normalizeRuleQuote, weakenedRuleSeverity }')()
 
 let failed = 0
 function check(name, actual, expected) {
@@ -696,5 +698,251 @@ check('ledger: proven prover adds one', countProveAttempt(2, { attempted: true,
 const bareWrites = src.split('\n').filter(l => /proveAttemptCount\s*(\+\+|\+=|=[^=])/.test(l) && !/countProveAttempt\(|let proveAttemptCount/.test(l))
 check('the attempt count is written only through countProveAttempt', bareWrites, [])
 
+console.log('\nproject rules: PROJECT:<slug> findings must quote a rule that exists')
+const { spawnSync: spawnPr } = await import('node:child_process')
+const { mkdtempSync: mkPr, cpSync: cpPr, readFileSync: rdPr, rmSync: rmPr, symlinkSync: syPr, writeFileSync: wfPr } = await import('node:fs')
+const { tmpdir: tmpPr } = await import('node:os')
+const { validateProjectRuleFinding, validateWeakenedProjectRuleFinding, isProjectRuleTag, normalizeQuote } =
+  await import('./project-rule-findings.mjs')
+
+const fixtureDir = join(SKILL, 'scripts', 'fixtures', 'project-rules')
+const prRepo = mkPr(join(tmpPr(), 'lekker-pr-'))
+cpPr(join(fixtureDir, 'CLAUDE.md'), join(prRepo, 'CLAUDE.md'))
+const prGit = (...a) => spawnPr('git', ['-C', prRepo, '-c', 'user.name=t', '-c', 'user.email=t@t', ...a], { encoding: 'utf8' })
+prGit('init', '-q', '-b', 'main'); prGit('add', '.'); prGit('commit', '-qm', 'rules')
+const prOut = join(prRepo, 'rules.json')
+const collected = spawnPr('bash', [join(SKILL, 'scripts', 'setup-worktree.sh'), 'o/r', 'main', prOut], {
+  encoding: 'utf8', env: { ...process.env, LEKKER_RULES_ONLY: '1', LEKKER_LOCAL_REPO: prRepo },
+})
+const planted = collected.status === 0 ? JSON.parse(rdPr(prOut, 'utf8')).projectRules : ''
+check('rules collection exits 0 on the planted fixture', collected.status, 0)
+check('projectRules carries both planted rules',
+  [planted.includes('NEVER call console.log in src/.'), planted.includes('NEVER mutate function arguments.')], [true, true])
+rmPr(prRepo, { recursive: true, force: true })
+
+const prFinding = (rule, ruleQuote) => ({ rule, ruleQuote, file: 'src/total.js', line: 2, title: 't' })
+check('accepts PROJECT:no-console-log with a matching quote',
+  validateProjectRuleFinding(prFinding('PROJECT:no-console-log', 'NEVER call console.log in src/.'), planted).ok, true)
+check('accepts a quote that differs only in case and spacing',
+  validateProjectRuleFinding(prFinding('PROJECT:no-mutation', 'never  mutate   function arguments'), planted).ok, true)
+check('accepts exact short project rules',
+  validateProjectRuleFinding(prFinding('PROJECT:no-eval', 'NEVER eval.'), '- NEVER eval.').ok, true)
+check('rejects altered identifiers in project rule quotes',
+  validateProjectRuleFinding(prFinding('PROJECT:no-unsafe', 'NEVER call unsafe().'), 'NEVER call `_unsafe()`.').ok, false)
+check('rejects altered operators in project rule quotes',
+  validateProjectRuleFinding(prFinding('PROJECT:nonnegative', 'MUST validate n = 0.'), 'MUST validate n >= 0.').ok, false)
+check('rejects a quote that is absent from projectRules',
+  validateProjectRuleFinding(prFinding('PROJECT:no-eval', 'NEVER call eval anywhere in the codebase'), planted).ok, false)
+check('rejects a PROJECT tag with no quote',
+  validateProjectRuleFinding({ rule: 'PROJECT:no-console-log' }, planted).ok, false)
+const weakenedFinding = prFinding('weakens-project-rule', 'NEVER call console.log in src/.')
+check('accepts a weakened rule quoted from baseProjectRules',
+  validateWeakenedProjectRuleFinding(weakenedFinding, planted).ok, true)
+check('rejects a weakened rule quote absent from baseProjectRules',
+  validateWeakenedProjectRuleFinding(weakenedFinding, 'NEVER call eval.').ok, false)
+check('rejects a weakened rule when baseProjectRules is unavailable',
+  validateWeakenedProjectRuleFinding(weakenedFinding, undefined).ok, false)
+check('rejects a weakened rule whose quote is still in projectRules',
+  validateWeakenedProjectRuleFinding(weakenedFinding, planted, planted).ok, false)
+check('accepts a weakened rule whose quote is gone from projectRules',
+  validateWeakenedProjectRuleFinding(weakenedFinding, planted, 'nothing here').ok, true)
+const evalBase = '- NEVER call eval in src'
+const evalFinding = prFinding('weakens-project-rule', 'NEVER call eval in src')
+check('accepts a weakening that appends an exception to the rule line',
+  validateWeakenedProjectRuleFinding(evalFinding, evalBase, '- NEVER call eval in src unless input is trusted').ok, true)
+check('accepts a weakening that adds a period and an Exception sentence on the same line',
+  validateWeakenedProjectRuleFinding(evalFinding, evalBase, '- NEVER call eval in src. Exception: trusted input.').ok, true)
+check('rejects a weakened rule whose line is unchanged among other lines',
+  validateWeakenedProjectRuleFinding(evalFinding, evalBase, '# Rules\n- NEVER call eval in src\n- Be kind').reason, 'rule still present in projectRules')
+const wrappedBase = '- After ANY catalog change, run build and commit\n  the result'
+const wrappedFinding = prFinding('weakens-project-rule', 'After ANY catalog change, run build and commit the result')
+check('accepts a weakening appended to the last line of a wrapped rule',
+  validateWeakenedProjectRuleFinding(wrappedFinding, wrappedBase, '- After ANY catalog change, run build and commit\n  the result, except docs-only changes').ok, true)
+check('rejects an unchanged wrapped rule',
+  validateWeakenedProjectRuleFinding(wrappedFinding, wrappedBase, wrappedBase).reason, 'rule still present in projectRules')
+check('rejects a wrapped rule re-wrapped at a different column',
+  validateWeakenedProjectRuleFinding(wrappedFinding, wrappedBase, '- After ANY catalog change, run build\n  and commit the result').reason, 'rule still present in projectRules')
+check('rejects a rule whose bullet marker changed to an asterisk',
+  validateWeakenedProjectRuleFinding(evalFinding, evalBase, '* NEVER call eval in src').reason, 'rule still present in projectRules')
+check('rejects an unchanged numbered rule',
+  validateWeakenedProjectRuleFinding(evalFinding, '1. NEVER call eval in src', '1. NEVER call eval in src').reason, 'rule still present in projectRules')
+check('rejects a bullet rule renumbered in the PR',
+  validateWeakenedProjectRuleFinding(evalFinding, evalBase, '1. NEVER call eval in src').reason, 'rule still present in projectRules')
+check('accepts a weakening that adds a prefix qualifier before the quote',
+  validateWeakenedProjectRuleFinding(prFinding('weakens-project-rule', 'NEVER force-push'), '- NEVER force-push', '- Except on your own branch, NEVER force-push').ok, true)
+check('accepts a weakening added on a new continuation line of the same bullet',
+  validateWeakenedProjectRuleFinding(wrappedFinding, wrappedBase + '.', wrappedBase + '.\n  Docs-only changes are exempt.').ok, true)
+check('rejects a single-line rule re-wrapped over two lines',
+  validateWeakenedProjectRuleFinding(wrappedFinding, '- After ANY catalog change, run build and commit the result', wrappedBase).reason, 'rule still present in projectRules')
+check('rejects a rule moved to another section unchanged',
+  validateWeakenedProjectRuleFinding(evalFinding, '# A\n' + evalBase + '\n# B\n- x', '# B\n- x\n# A\n' + evalBase).reason, 'rule still present in projectRules')
+check('accepts an exception appended to a two-line blockquote rule',
+  validateWeakenedProjectRuleFinding(prFinding('weakens-project-rule', 'NEVER force-push to main or release branches.'), '> NEVER force-push to main\n> or release branches.', '> NEVER force-push to main\n> or release branches. Exception: your own branch.').ok, true)
+check('accepts an exception added as an indented sub-bullet',
+  validateWeakenedProjectRuleFinding(prFinding('weakens-project-rule', 'NEVER force-push'), '- NEVER force-push', '- NEVER force-push\n  - except on your own branch').ok, true)
+check('accepts a parent bullet narrowed above an unchanged sub-bullet',
+  validateWeakenedProjectRuleFinding(prFinding('weakens-project-rule', 'NEVER call eval'), '- In src:\n  - NEVER call eval', '- In src/legacy only:\n  - NEVER call eval').ok, true)
+check('accepts a quote spanning two base bullets when the second gains an exception',
+  validateWeakenedProjectRuleFinding(prFinding('weakens-project-rule', 'NEVER force-push\n- NEVER delete main'), '- NEVER force-push\n- NEVER delete main', '- NEVER force-push\n- NEVER delete main unless asked').ok, true)
+check('rejects an unchanged rule with an unchanged nested sub-bullet',
+  validateWeakenedProjectRuleFinding(prFinding('weakens-project-rule', 'NEVER force-push'), '- NEVER force-push\n  - on shared branches', '- NEVER force-push\n  - on shared branches').reason, 'rule still present in projectRules')
+check('accepts an exception sub-bullet added after a blank line in a loose list',
+  validateWeakenedProjectRuleFinding(prFinding('weakens-project-rule', 'NEVER force-push'), '- NEVER force-push', '- NEVER force-push\n\n  - except on your own branch').ok, true)
+check('accepts an indented exception paragraph added after a blank line',
+  validateWeakenedProjectRuleFinding(prFinding('weakens-project-rule', 'NEVER force-push'), '- NEVER force-push', '- NEVER force-push\n\n  Except on your own branch.').ok, true)
+const introBase = 'These apply everywhere.\n- In domain code:\n  - NEVER mutate state'
+check('accepts a narrowed parent bullet under an intro paragraph',
+  validateWeakenedProjectRuleFinding(prFinding('weakens-project-rule', 'NEVER mutate state'), introBase, 'These apply everywhere.\n- In domain code, except scripts:\n  - NEVER mutate state').ok, true)
+check('accepts an exception sibling added under a parent bullet below an intro paragraph',
+  validateWeakenedProjectRuleFinding(prFinding('weakens-project-rule', 'NEVER mutate state'), introBase, introBase + '\n  - Mutation is fine in reducers').ok, true)
+check('rejects an unchanged loose-list rule with an unchanged indented paragraph',
+  validateWeakenedProjectRuleFinding(prFinding('weakens-project-rule', 'NEVER force-push'), '- NEVER force-push\n\n  on shared branches', '- NEVER force-push\n\n  on shared branches').reason, 'rule still present in projectRules')
+check('rejects unchanged blank-separated sibling bullets when another bullet is edited',
+  validateWeakenedProjectRuleFinding(prFinding('weakens-project-rule', 'NEVER force-push'), '- NEVER force-push\n\n- NEVER call eval', '- NEVER force-push\n\n- NEVER call eval in src').reason, 'rule still present in projectRules')
+check('rejects an unchanged bullet under a lead-in when a sibling is edited',
+  validateWeakenedProjectRuleFinding(prFinding('weakens-project-rule', 'NEVER force-push'), 'Rules:\n- NEVER force-push\n- NEVER call eval', 'Rules:\n- NEVER force-push\n- NEVER call eval, except tests').reason, 'rule still present in projectRules')
+check('rejects a weakened rule with no quote',
+  validateWeakenedProjectRuleFinding({ rule: 'weakens-project-rule' }, planted).ok, false)
+const verifierInstructions = rdPr(join(SKILL, 'references', 'agents', 'verifier.md'), 'utf8')
+check('verifier has a dedicated weakened-project-rule path',
+  verifierInstructions.includes('For `rule: "weakens-project-rule"`, use this dedicated path:'), true)
+check('verifier accepts deleted and replacement-line anchors',
+  verifierInstructions.includes('valid for both a deletion and a replacement'), true)
+check('verifier confirms valid weakened rules at Important severity',
+  verifierInstructions.includes("`confirmed` at the finding's Important severity"), true)
+check('rejects a malformed slug', validateProjectRuleFinding(prFinding('PROJECT:No Console', 'NEVER call console.log in src/.'), planted).ok, false)
+check('a built-in tag is left to the house-rule path', validateProjectRuleFinding({ rule: 'TS-1' }, planted).ok, true)
+const withRecalled = 'NEVER eval anywhere in src.\n## Recalled patterns\nNEVER call console.log in tests.'
+check('accepts a quote above the recalled patterns heading',
+  validateProjectRuleFinding(prFinding('PROJECT:no-eval', 'NEVER eval anywhere in src.'), withRecalled).ok, true)
+check('rejects a quote that appears only under recalled patterns',
+  validateProjectRuleFinding(prFinding('PROJECT:no-console-log', 'NEVER call console.log in tests.'), withRecalled).ok, false)
+const twoRecalled = 'NEVER eval anywhere in src.\n## Recalled patterns\nNEVER use var in src.\n## Recalled patterns\nNEVER call console.log in tests.'
+check('accepts a quote between two recalled patterns headings',
+  validateProjectRuleFinding(prFinding('PROJECT:no-var', 'NEVER use var in src.'), twoRecalled).ok, true)
+check('rejects a quote after the last recalled patterns heading when the heading appears twice',
+  validateProjectRuleFinding(prFinding('PROJECT:no-console-log', 'NEVER call console.log in tests.'), twoRecalled).ok, false)
+console.log('\nworkflow: a house-rule finding and a PROJECT finding on one line are never one issue')
+const houseF = { file: 'src/total.js', line: 2, title: 'Missing null check on total', rule: 'TS-1' }
+const projectF = { file: 'src/total.js', line: 2, title: 'Missing null check on total', rule: 'PROJECT:no-null-total', ruleQuote: 'NEVER skip the null check on total.' }
+check('a house-rule finding and a PROJECT finding with similar titles are not sameIssue', sameIssue(houseF, projectF), false)
+check('isProjectRuleTag accepts a kebab slug and rejects an empty one',
+  [isProjectRuleTag('PROJECT:a-b'), isProjectRuleTag('PROJECT:')], [true, false])
+check('a PROJECT tag is a hard rule', isHardRule({ rule: 'PROJECT:no-console-log' }), true)
+const quoteA = { file: 'src/total.js', line: 2, title: 'Missing null check on total', rule: 'PROJECT:no-null-total', ruleQuote: 'NEVER skip the null check on total.' }
+const quoteB = { ...quoteA, ruleQuote: 'ALWAYS validate total before use.' }
+check('two different quotes of one PROJECT rule are not sameIssue', sameIssue(quoteA, quoteB), false)
+check('the same quote of one PROJECT rule is still sameIssue', sameIssue(quoteA, { ...quoteA }), true)
+check('the same slug with quotes equal after normalisation is sameIssue',
+  sameIssue(quoteA, { ...quoteA, ruleQuote: '  never   SKIP the null check on total.  ' }), true)
+const slugB = { ...quoteA, rule: 'PROJECT:null-total-guard', ruleQuote: '**Never skip** the null check on total.' }
+check('two PROJECT slugs with one quote modulo case, whitespace and emphasis are sameIssue', sameIssue(quoteA, slugB), true)
+const [mergedSlugs] = dedup([{ ...quoteA, severity: 'important' }, { ...slugB, severity: 'important' }])
+check('different-slug same-quote findings merge into one finding that keeps rule and quote',
+  [dedup([{ ...quoteA, severity: 'important' }, { ...slugB, severity: 'important' }]).length, mergedSlugs.rule, typeof mergedSlugs.ruleQuote],
+  [1, 'PROJECT:no-null-total', 'string'])
+check('different-slug different-quote findings stay separate',
+  sameIssue(quoteA, { ...slugB, ruleQuote: 'ALWAYS validate total before use.' }), false)
+const quoteSamples = ['NEVER call `console.log` in src/.', '> **Never** skip\n  the   check', '- Use _early_ returns', '## Heading rule text']
+check('workflow normalizeRuleQuote agrees with the validator normalizeQuote',
+  quoteSamples.map(q => normalizeRuleQuote(q)), quoteSamples.map(q => normalizeQuote(q)))
+check('quotes differing only by trailing punctuation are not sameIssue',
+  sameIssue(quoteA, { ...quoteA, ruleQuote: 'NEVER skip the null check on total' }), false)
+console.log('\nworkflow: a confirmed weakened-rule finding is always Important')
+check('critical from the lens becomes important for weakens-project-rule',
+  weakenedRuleSeverity({ rule: 'weakens-project-rule' }, 'critical'), 'important')
+check('other rules keep the severity', weakenedRuleSeverity({ rule: 'TS-1' }, 'critical'), 'critical')
+
+// Prompt guard: every lens that reads projectRules is told to raise the tag.
+const lensFiles = ['quality', 'implementation', 'simplification', 'conventions', 'test-quality']
+check('every lens file that reads projectRules carries the PROJECT instruction',
+  lensFiles.filter(n => {
+    const t = rdPr(join(SKILL, 'references', 'agents', `${n}.md`), 'utf8')
+    return t.includes('"projectRules"') && !t.includes('PROJECT:<slug>')
+  }), [])
+// Behavioural: lift the real reviewPrompt and build prompts with it. Removing the
+// append in reviewPrompt makes the listed-lens check fail.
+function liftBlock(name) {
+  const m = new RegExp(`^const ${name} = [\\s\\S]*?\\n\\n`, 'm').exec(src)
+  if (!m) throw new Error(`selftest: const ${name} not found in workflow.js`)
+  return m[0]
+}
+// An older workflow.js lacks these constants; fall back so the checks FAIL instead of the suite crashing.
+const liftBlockOr = name => { try { return liftBlock(name) } catch { return `const ${name} = ''\n` } }
+const buildPrompt = new Function(
+  'dim', 'SUPPRESSED', 'prevSha',
+  [liftBlockOr('PROJECT_RULE_DIMENSIONS'), liftBlockOr('PROJECT_RULE_INSTRUCTION'), liftConst('BUG_CLASS_INSTRUCTION'),
+    `const targetMetadata = '{}', promptDir = 'p', repoSlug = 'o/r', prNumber = 1, prUrl = 'u',
+       diffFile = 'd', contextFile = 'c', wtDisplay = 'w'`,
+    lift('reviewPrompt'), 'return reviewPrompt(dim)'].join('\n'),
+)
+const promptFor = key => buildPrompt({ key, file: `${key}.md` }, [], null)
+check('a listed lens prompt carries the PROJECT instruction',
+  lensFiles.map(n => promptFor(n).includes('"PROJECT:<short-kebab-slug>"')), lensFiles.map(() => true))
+check('an unlisted lens prompt does not', promptFor('deps').includes('PROJECT:<short-kebab-slug>'), false)
+
+console.log('\nproject rules: dedup keeps the tag and its quote together')
+const { dedup: dedupPr } = new Function(preamble + '\nreturn { dedup }')()
+const plainF = { file: 'src/a.js', line: 2, severity: 'important', title: 'console.log left in src', bugClass: 'console-log', description: 'x', badCode: 'console.log(1)', fix: 'f', otherInstances: [] }
+const taggedF = { ...plainF, severity: 'critical', rule: 'PROJECT:no-console-log', ruleQuote: 'NEVER call console.log in src/.' }
+const taggedWithoutQuote = { ...taggedF }
+delete taggedWithoutQuote.ruleQuote
+for (const [label, pair] of [['plain first', [plainF, taggedF]], ['tagged first', [taggedF, plainF]]]) {
+  const [m] = dedupPr(pair)
+  check(`merge keeps rule and ruleQuote (${label})`, [m.rule, m.ruleQuote], ['PROJECT:no-console-log', 'NEVER call console.log in src/.'])
+}
+const [mergedQuote] = dedupPr([taggedWithoutQuote, taggedF])
+check('merge fills missing quote for the same project rule',
+  [mergedQuote.rule, mergedQuote.ruleQuote], ['PROJECT:no-console-log', 'NEVER call console.log in src/.'])
+
+const strayQuote = { ...plainF, ruleQuote: 'stale quote that belongs to no rule' }
+const [mergedStray] = dedupPr([strayQuote, taggedF])
+check('a stray quote on an untagged side does not survive the merge',
+  [mergedStray.rule, mergedStray.ruleQuote], ['PROJECT:no-console-log', 'NEVER call console.log in src/.'])
+const [mergedLate] = dedupPr([{ ...plainF, rule: 'PROJECT:no-console-log' }, taggedF])
+check('a quote from a later finding fills a quote-less same rule', mergedLate.ruleQuote, 'NEVER call console.log in src/.')
+const otherRule = { ...taggedF, rule: 'PROJECT:no-mutation', ruleQuote: 'NEVER mutate function arguments.' }
+check('two different PROJECT rules stay separate through dedup', dedupPr([taggedF, otherRule]).length, 2)
+const [mergedNoQuote] = dedupPr([strayQuote, { ...taggedF, ruleQuote: undefined }])
+check('a tagged side without a quote leaves no stray quote behind', mergedNoQuote.ruleQuote, undefined)
+
+console.log('\nproject rules: validator crash is exit 2, rejection is exit 1')
+const crashDir = mkPr(join(tmpPr(), 'lekker-crash-'))
+const okCtx = join(crashDir, 'ctx.json'), badJson = join(crashDir, 'bad.json'), fnd = join(crashDir, 'f.json')
+wfPr(okCtx, JSON.stringify({ projectRules: 'NEVER call console.log in src/.' }))
+wfPr(badJson, '{not json')
+wfPr(fnd, JSON.stringify({ rule: 'PROJECT:no-console-log', ruleQuote: 'NEVER call console.log in src/.' }))
+const runV = (f, c) => spawnPr('node', [join(SKILL, 'scripts', 'project-rule-findings.mjs'), f, c], { encoding: 'utf8' }).status
+check('exit 0 on a valid finding', runV(fnd, okCtx), 0)
+// A PR that deletes the rule must not make its own violation pass: base rules win.
+const spoofCtx = join(crashDir, 'spoof.json')
+wfPr(spoofCtx, JSON.stringify({ projectRules: 'nothing here', baseProjectRules: 'NEVER call console.log in src/.' }))
+check('quote found in base rules is accepted even when the PR tree dropped it', runV(fnd, spoofCtx), 0)
+const addedCtx = join(crashDir, 'added.json')
+wfPr(addedCtx, JSON.stringify({ projectRules: 'NEVER call console.log in src/.', baseProjectRules: '' }))
+check('a rule only the PR tree contains is rejected when base rules exist', runV(fnd, addedCtx), 1)
+const weakenedFile = join(crashDir, 'weakened.json')
+wfPr(weakenedFile, JSON.stringify(weakenedFinding))
+check('validator accepts a weakened-rule quote found in baseProjectRules',
+  runV(weakenedFile, spoofCtx), 0)
+check('validator rejects a weakened-rule quote found only in projectRules',
+  runV(weakenedFile, addedCtx), 1)
+wfPr(join(crashDir, 'rej.json'), JSON.stringify({ rule: 'PROJECT:no-eval', ruleQuote: 'NEVER call eval anywhere in code' }))
+const noBaseCtx = join(crashDir, 'nobase.json')
+wfPr(noBaseCtx, JSON.stringify({ projectRules: 'nothing here' }))
+check('exit 2 on a weakened finding when baseProjectRules is missing', runV(weakenedFile, noBaseCtx), 2)
+const stillCtx = join(crashDir, 'still.json')
+wfPr(stillCtx, JSON.stringify({ projectRules: 'NEVER call console.log in src/.', baseProjectRules: 'NEVER call console.log in src/.' }))
+check('exit 1 on a weakened finding whose rule is still in projectRules', runV(weakenedFile, stillCtx), 1)
+check('exit 1 on a rejected finding', runV(join(crashDir, 'rej.json'), okCtx), 1)
+const symlinkValidator = join(crashDir, 'project-rule-findings.mjs')
+syPr(join(SKILL, 'scripts', 'project-rule-findings.mjs'), symlinkValidator)
+check('exit 1 on a rejected finding through a symlink',
+  spawnPr('node', [symlinkValidator, join(crashDir, 'rej.json'), okCtx], { encoding: 'utf8' }).status, 1)
+check('exit 2 on a missing context file', runV(fnd, join(crashDir, 'nope.json')), 2)
+check('exit 2 on a malformed context file', runV(fnd, badJson), 2)
+check('exit 2 on a malformed finding file', runV(badJson, okCtx), 2)
+rmPr(crashDir, { recursive: true, force: true })
+
 console.log(failed === 0 ? '\nall checks passed\n' : `\n${failed} check(s) FAILED\n`)
 process.exit(failed === 0 ? 0 : 1)

package/plugins/olko-github-pr/skills/lekker-review/scripts/setup-worktree.sh

@@ -134,6 +134,20 @@ collect_project_rules() {
         -not -path '*/node_modules/*' 2>/dev/null | sort)
 }
 
+# Hard rules must come from a tree the PR author does not control: a PR that
+# deletes a rule and then breaks it would otherwise leave nothing to enforce.
+collect_project_rules_at_ref() {
+    local repo="$1" ref="$2" dir status=0
+    dir="$(mktemp -d "/tmp/lekker-base-rules-XXXXXX")"
+    if git -C "$repo" archive "$ref" 2>/dev/null | tar -x -C "$dir" 2>/dev/null; then
+        collect_project_rules "$dir"
+    else
+        status=1
+    fi
+    rm -rf "$dir"
+    return "$status"
+}
+
 # Scan depth needs PR-authored review guidance but skips expensive worktree
 # setup. Read the PR tree from an archive so no Git worktree or checkout is made.
 if [[ "${LEKKER_RULES_ONLY:-}" == "1" ]]; then
@@ -143,20 +157,57 @@ if [[ "${LEKKER_RULES_ONLY:-}" == "1" ]]; then
         if git -C "$REPO_ROOT" fetch origin "+refs/heads/${PR_BRANCH}:refs/remotes/origin/${PR_BRANCH}" 2>/dev/null; then
             RULES_REF="origin/$PR_BRANCH"
         elif git -C "$REPO_ROOT" fetch origin "$PR_BRANCH" 2>/dev/null; then
-            RULES_REF=FETCH_HEAD
+            # The base fetch below overwrites FETCH_HEAD, so pin the PR tip now.
+            RULES_REF="$(git -C "$REPO_ROOT" rev-parse FETCH_HEAD)"
         else
             printf 'ERROR: could not fetch PR branch %s for rules-only scan\n' "$PR_BRANCH" >&2
             exit 1
         fi
     fi
+    # Base rules are best effort: a failure here keeps projectRules and nulls baseProjectRules,
+    # because the base copy only hardens validation and must not abort the scan.
+    RULES_BASE_SHA=""
+    if [[ -n "${LEKKER_BASE_REF:-}" ]]; then
+        BASE_FETCH_OK=1
+        if [[ -z "$LOCAL_REPO" && "$LEKKER_BASE_REF" == origin/* ]]; then
+            BASE_BRANCH="${LEKKER_BASE_REF#origin/}"
+            git -C "$REPO_ROOT" fetch origin \
+                "+refs/heads/${BASE_BRANCH}:refs/remotes/origin/${BASE_BRANCH}" 2>/dev/null || BASE_FETCH_OK=0
+        fi
+        # Fork point, as in full mode: the base tip may carry rules added after the PR branched.
+        if [[ "$BASE_FETCH_OK" == "1" ]] \
+            && git -C "$REPO_ROOT" rev-parse --verify -q "${LEKKER_BASE_REF}^{commit}" >/dev/null; then
+            RULES_BASE_SHA="$(git -C "$REPO_ROOT" merge-base "$LEKKER_BASE_REF" "$RULES_REF" 2>/dev/null || true)"
+            # A fork older than the shallow clone depth has no common ancestor until history is deepened.
+            if [[ -z "$RULES_BASE_SHA" ]] \
+                && [[ "$(git -C "$REPO_ROOT" rev-parse --is-shallow-repository 2>/dev/null)" == "true" ]]; then
+                git -C "$REPO_ROOT" fetch -q --deepen=200 origin 2>/dev/null || true
+                RULES_BASE_SHA="$(git -C "$REPO_ROOT" merge-base "$LEKKER_BASE_REF" "$RULES_REF" 2>/dev/null || true)"
+            fi
+        fi
+    fi
     RULES_SOURCE="/tmp/lekker-rules-source-$$"
     mkdir -p "$RULES_SOURCE"
     git -C "$REPO_ROOT" archive "$RULES_REF" | tar -x -C "$RULES_SOURCE"
     PROJECT_RULES="$(collect_project_rules "$RULES_SOURCE")"
-    python3 - "$OUT_JSON" "$PROJECT_RULES" <<'PYEOF'
+    BASE_PROJECT_RULES=""
+    HAVE_BASE_RULES=0
+    if [[ -n "${LEKKER_BASE_REF:-}" ]]; then
+        if [[ -n "$RULES_BASE_SHA" ]] \
+            && BASE_PROJECT_RULES="$(collect_project_rules_at_ref "$REPO_ROOT" "$RULES_BASE_SHA")"; then
+            HAVE_BASE_RULES=1
+        else
+            BASE_PROJECT_RULES=""
+            NOTES="${NOTES}base-rules-unavailable;"
+        fi
+    fi
+    python3 - "$OUT_JSON" "$PROJECT_RULES" "$BASE_PROJECT_RULES" "$HAVE_BASE_RULES" "$NOTES" <<'PYEOF'
 import json, sys
+out = {"projectRules": sys.argv[2]}
+out["baseProjectRules"] = sys.argv[3] if sys.argv[4] == "1" else None
+out["notes"] = sys.argv[5]
 with open(sys.argv[1], "w") as f:
-    json.dump({"projectRules": sys.argv[2]}, f, indent=2)
+    json.dump(out, f, indent=2)
 PYEOF
     rm -rf "$RULES_SOURCE"
     printf 'OK %s\n' "$OUT_JSON"
@@ -475,6 +526,20 @@ PROJECT_RULES_FILE="/tmp/lekker-rules-$$.txt"
 printf '' > "$PROJECT_RULES_FILE"
 collect_project_rules "$WORKTREE_PATH" > "$PROJECT_RULES_FILE"
 
+BASE_RULES_FILE="/tmp/lekker-base-rules-$$.txt"
+BASE_RULES_STATE="absent"
+printf '' > "$BASE_RULES_FILE"
+if [[ -n "$MERGE_BASE_NOTE" && "$MERGE_BASE_NOTE" != "unknown" ]] \
+    && git -C "$REPO_ROOT" rev-parse --verify -q "${MERGE_BASE_NOTE}^{commit}" >/dev/null; then
+    if collect_project_rules_at_ref "$REPO_ROOT" "$MERGE_BASE_NOTE" > "$BASE_RULES_FILE"; then
+        BASE_RULES_STATE="present"
+    else
+        NOTES="${NOTES}base-rules-unavailable;"
+    fi
+else
+    NOTES="${NOTES}base-rules-unavailable;"
+fi
+
 # ---------------------------------------------------------------------------
 # 6. HEAD SHA
 # ---------------------------------------------------------------------------
@@ -518,14 +583,17 @@ python3 - \
     "$DEPS_INSTALL_FILE" \
     "$ESLINT_JSON_FILE" \
     "$TEST_RUNNER_JSON" \
-    "$OUT_JSON" <<'PYEOF'
+    "$OUT_JSON" \
+    "$BASE_RULES_FILE" \
+    "$BASE_RULES_STATE" <<'PYEOF'
 import json, sys, os
 
 (worktree_path, repo_root, head_sha, head_sha_short,
  tsc_file, eslint_file, rules_file, delta_file, notes,
  changed_files_file, base_ref_val, eslint_scope_file,
  tsc_changed_file, tsc_count_file, merge_base_val,
- deps_install_file, eslint_json_file, test_runner_json, out_json) = sys.argv[1:20]
+ deps_install_file, eslint_json_file, test_runner_json, out_json,
+ base_rules_file, base_rules_state) = sys.argv[1:22]
 
 def parse_runner(raw):
     try:
@@ -581,6 +649,7 @@ data = {
     "tscTail":        read_file(tsc_file),
     "eslintTail":     read_file(eslint_file),
     "projectRules":   read_file(rules_file),
+    "baseProjectRules": read_file(base_rules_file) if base_rules_state == "present" else None,
     "deltaFile":      None if delta_file == "null" else delta_file,
     "notes":          notes,
     "changedFiles":   changed_files,
@@ -598,7 +667,7 @@ data = {
     "eslintJson":     eslint_json_file if file_has_content(eslint_json_file) else None,
 }
 
-for p in (tsc_file, eslint_file, rules_file, changed_files_file,
+for p in (tsc_file, eslint_file, rules_file, base_rules_file, changed_files_file,
           eslint_scope_file, tsc_changed_file, tsc_count_file,
           deps_install_file):
     try:

package/plugins/olko-github-pr/skills/lekker-review/scripts/validate-lines.mjs

@@ -75,6 +75,8 @@ export function loadDedup(workflowPath = join(SKILL, 'workflow.js')) {
     liftConst('HARD_RULES', 'const HARD_RULES = new Set()'),
     liftConst('SAME_ISSUE_LINE_WINDOW', 'const SAME_ISSUE_LINE_WINDOW = 30'),
     liftConst('SEVERITY_RANK', 'const SEVERITY_RANK = { critical: 3, important: 2, observation: 1, idiomatic: 0 }'),
+    // Absent from an older workflow.js, whose sameIssue does not call it.
+    (() => { try { return lift('normalizeRuleQuote') } catch { return '' } })(),
     ...['titleTokens', 'sameIssue', 'nearbyLines', 'spanWithinWindow',
         'isHardRule', 'longest', 'mergeFindings', 'dedup'].map(lift),
   ].join('\n')

package/plugins/olko-github-pr/skills/lekker-review/workflow.js

@@ -33,6 +33,7 @@ const FINDINGS_ARRAY_SCHEMA = {
     anyOf: [
       { properties: { severity: { enum: ['observation', 'idiomatic'] } } },
       { required: ['boundary'] },
+      { required: ['rule'], properties: { rule: { pattern: '^(PROJECT:[a-z0-9]+(-[a-z0-9]+)*|weakens-project-rule)$' } } },
     ],
     properties: {
       file:        { type: 'string' },
@@ -44,6 +45,8 @@ const FINDINGS_ARRAY_SCHEMA = {
       fix:         { type: 'string' },
       precedent:   { type: 'string' },
       rule:        { type: 'string', minLength: 1, pattern: '\\S' },
+      // Verbatim project rule a PROJECT:<slug> finding enforces.
+      ruleQuote:   { type: 'string' },
       boundary:    BOUNDARY_SCHEMA,
       // Short kebab-case slug naming the class of bug ("missing-null-check").
       bugClass:    { type: 'string', minLength: 1, pattern: '^[a-z0-9]+(-[a-z0-9]+)*$' },
@@ -107,6 +110,8 @@ const VERDICT_SCHEMA = {
     verdict:     { enum: ['confirmed', 'downgraded', 'dropped'] },
     newSeverity: { enum: ['important', 'observation'] },
     reasoning:   { type: 'string' },
+    // True when the PROJECT-rule validator could not run (exit other than 0 or 1).
+    validatorUnavailable: { type: 'boolean' },
   },
 }
 
@@ -161,7 +166,41 @@ function titleTokens(title) {
   return words.filter(function(w) { return w.length > 2 })
 }
 
+// Same normalisation as normalizeQuote in scripts/project-rule-findings.mjs; workflow.js cannot import it.
+// The selftest asserts the two agree.
+function normalizeRuleQuote(text) {
+  return String(text == null ? '' : text)
+    .replace(/(^|\n)\s{0,3}#{1,6}\s+/g, '$1')
+    .replace(/(^|\n)\s{0,3}>\s?/g, '$1')
+    .replace(/`([^`\n]+)`/g, '$1')
+    .replace(/(^|[\s([{])(\*{1,2}|_{1,2})(\S(?:.*?\S)?)\2(?=$|[\s.,;:!?)}\]])/g, '$1$3')
+    .replace(/^\s*[-+]\s+/gm, ' ')
+    .replace(/\s+/g, ' ')
+    .trim()
+    .toLowerCase()
+}
+
+function weakenedRuleSeverity(finding, severity) {
+  return finding.rule === 'weakens-project-rule' ? 'important' : severity
+}
+
 function sameIssue(a, b) {
+  const qa = normalizeRuleQuote(a.ruleQuote)
+  const qb = normalizeRuleQuote(b.ruleQuote)
+  // Lens-generated slugs can differ even when they identify the same project rule.
+  const sameProjectQuote = typeof a.rule === 'string' && a.rule.startsWith('PROJECT:')
+    && typeof b.rule === 'string' && b.rule.startsWith('PROJECT:')
+    && qa !== '' && qa === qb
+  if (typeof a.rule === 'string' && typeof b.rule === 'string' && a.rule !== b.rule
+      && (a.rule.startsWith('PROJECT:') || b.rule.startsWith('PROJECT:'))
+      && !sameProjectQuote) {
+    return false
+  }
+  // Two quotes of one PROJECT rule that differ are two different rule passages, not one issue.
+  if (typeof a.rule === 'string' && a.rule === b.rule && a.rule.startsWith('PROJECT:')
+      && qa !== '' && qb !== '' && qa !== qb) {
+    return false
+  }
   // Merging two classes would send one class's instances to the other's fix.
   if (a.bugClass && b.bugClass && a.bugClass !== b.bugClass) {
     return false
@@ -182,6 +221,22 @@ const BUG_CLASS_INSTRUCTION = `BUG CLASS: give every finding a "bugClass" (short
   + ` hit, search the whole diff for the same pattern and list every other place as`
   + ` "file:line" (empty array when there is none). Report the class, not just the first hit.`
 
+const PROJECT_RULE_DIMENSIONS = ['quality', 'implementation', 'simplification', 'conventions', 'test-quality',
+  'triage-quality', 'triage-logic']
+
+const PROJECT_RULE_INSTRUCTION = `PROJECT RULES AS HARD RULES: read "projectRules" from CONTEXT_FILE.`
+  + ` When a changed line violates a project rule written as a prohibition or an obligation`
+  + ` (NEVER, MUST, MUST NOT, ALWAYS, DO NOT, or a plain-English equivalent), raise a Critical`
+  + ` finding with "rule" set to "PROJECT:<short-kebab-slug>", "ruleQuote" set to the exact`
+  + ` sentence from the rules (use "baseProjectRules" when it is a string: it is the base`
+  + ` branch's copy, which the PR author cannot edit; otherwise "projectRules"), and file:line`
+  + ` on the violating line. When the diff deletes or weakens a rule line that is in`
+  + ` baseProjectRules, raise an Important finding with rule "weakens-project-rule" quoting`
+  + ` the removed line. One finding per rule,`
+  + ` with every other violating site in "otherInstances". Never quote a rule that is not in`
+  + ` the authoritative source ("baseProjectRules" when it is a string, otherwise "projectRules"). Preferences and suggestions are not hard rules: report them as ordinary`
+  + ` findings. A REVIEW.md ignore entry narrows where you look, it never disables a rule.`
+
 const BUG_CLASS_PATTERN = /^[a-z0-9]+(-[a-z0-9]+)*$/
 const INSTANCE_PATTERN = new RegExp(INSTANCE_PATTERN_SOURCE)
 
@@ -234,6 +289,14 @@ function mergeFindings(a, b) {
 
   if (!merged.rule && b.rule) {
     merged.rule = b.rule
+    if (Object.prototype.hasOwnProperty.call(b, 'ruleQuote')) {
+      merged.ruleQuote = b.ruleQuote
+    } else {
+      delete merged.ruleQuote
+    }
+  } else if (merged.rule && merged.rule === b.rule && !merged.ruleQuote
+      && typeof b.ruleQuote === 'string' && b.ruleQuote.trim()) {
+    merged.ruleQuote = b.ruleQuote
   }
 
   const agreedBy = []
@@ -547,7 +610,7 @@ if (Number(cycle) >= RETHINK_CYCLE) {
     recurringClasses: Array.isArray(recurringClasses) ? recurringClasses : [],
     findings: [],
     preExisting: [],
-    droppedCount: 0, downgradedCount: 0, hardRuleCount: 0, agentCount: 0,
+    droppedCount: 0, downgradedCount: 0, hardRuleCount: 0, validatorUnavailableCount: 0, agentCount: 0,
     proveAttemptCount: 0, provenCount: 0, suppressedCount: 0,
     outputTokens: 0, turnTokensTotal: budget.spent(),
     engine: ENGINE,
@@ -562,6 +625,7 @@ const budgetAtStart = budget.spent()
   let droppedCount = 0
   let downgradedCount = 0
   let hardRuleCount = 0
+  let validatorUnavailableCount = 0
   let provenCount = 0
   let suppressedCount = 0
   let proveAttemptCount = 0
@@ -613,6 +677,10 @@ const budgetAtStart = budget.spent()
 
     prompt += ' ' + BUG_CLASS_INSTRUCTION
 
+    if (PROJECT_RULE_DIMENSIONS.includes(dim.key)) {
+      prompt += ' ' + PROJECT_RULE_INSTRUCTION
+    }
+
     // The deterministic lint pre-flight has already collected every rule the
     // repo's own eslint config fires on this diff, and those are exactly the
     // comments the bot reviewers bill for. An agent re-reporting them costs a
@@ -650,7 +718,7 @@ const budgetAtStart = budget.spent()
       `FINDING (JSON): ${JSON.stringify(finding)}.`,
       `DIFF_FILE=${diffFile}, CONTEXT_FILE=${contextFile}, WORKTREE_PATH=${wtDisplay}.`,
       `HOUSE_RULES_FILE: read key "houseRulesFile" from CONTEXT_FILE, then read that exact path before validating a hard rule.`,
-      `Default to dropping when uncertain.`,
+      `Default to dropping when uncertain, except when the PROJECT-rule validator was unavailable: then check by hand that the exact quote appears in baseProjectRules when it is a string, otherwise projectRules (drop if it does not), keep the finding only if it does, set validatorUnavailable true, and judge applicability. For rule "weakens-project-rule" check baseProjectRules ONLY: drop it when baseProjectRules is not a string or the quote is absent there, and never consult projectRules.`,
     ].join(' ')
   }
 
@@ -708,6 +776,9 @@ const budgetAtStart = budget.spent()
   // A model verdict cannot replace the required production boundary map.
   function enforceBoundary(finding) {
     if (!shouldVerify(finding, depth)) return finding
+    // A project rule or a weakened project rule is violated by the line itself; it needs no production entry point.
+    if (typeof finding.rule === 'string'
+        && (finding.rule.startsWith('PROJECT:') || finding.rule === 'weakens-project-rule')) return finding
     const boundary = finding.boundary
     const hasText = function(value) {
       return typeof value === 'string' && value.trim().length > 0
@@ -764,6 +835,11 @@ const budgetAtStart = budget.spent()
           return kept
         }
 
+        if (verdict.validatorUnavailable === true) {
+          validatorUnavailableCount++
+          log(`PROJECT-rule validator unavailable for ${finding.file}:${finding.line}; ${verdict.verdict === 'dropped' ? 'finding dropped' : 'finding kept'}`)
+        }
+
         if (verdict.verdict === 'dropped') {
           droppedCount++
           return null
@@ -780,6 +856,7 @@ const budgetAtStart = budget.spent()
 
         // confirmed
         const confirmed = Object.assign({}, finding)
+        confirmed.severity = weakenedRuleSeverity(finding, confirmed.severity)
         confirmed.verificationStatus = isHardRule(finding) ? 'hard-rule-confirmed' : 'confirmed'
         confirmed.verifierReasoning = verdict.reasoning
         return confirmed
@@ -1087,6 +1164,7 @@ const budgetAtStart = budget.spent()
     droppedCount,
     downgradedCount,
     hardRuleCount,
+    validatorUnavailableCount,
     agentCount,
     proveAttemptCount,
     provenCount,

package/plugins/olko-obsidian/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-obsidian",
   "description": "Keep an Obsidian vault in sync with work: PR sync, task rollover, morning routine.",
-  "version": "1.70.0",
+  "version": "1.71.1",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-product/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-product",
   "description": "Take a product idea to a shippable build: MVP passes, full-stack scaffolds, UX/UI quality loops, launch plans.",
-  "version": "1.70.0",
+  "version": "1.71.1",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-reflection/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-reflection",
   "description": "Look back and improve: self-critique, retrospectives, performance review, rapid learning.",
-  "version": "1.70.0",
+  "version": "1.71.1",
   "author": {
     "name": "Oleg Koval"
   },