@olegkoval/agent-skills 1.71.0 → 1.71.1

package/adapters/claude/olko-github-pr/skills/lekker-review/SKILL.md

@@ -476,7 +476,7 @@ LEKKER_RULES_ONLY=1 LEKKER_BASE_REF=origin/<BASE_BRANCH> \
 ```
 
 Read `projectRules` from `rules.json` into `context.json`. This archive-only
-mode fetches the PR base for `baseProjectRules` and does not run static checks.
+mode fetches the PR base and reads `baseProjectRules` at the merge base with the PR branch (as full mode does), not at the base tip. If the base cannot be fetched, resolved or merge-based, `baseProjectRules` is `null` and `notes` carries `base-rules-unavailable`; the scan still succeeds. It does not run static checks.
 
 Run via Bash with `run_in_background`:
 

package/adapters/claude/olko-github-pr/skills/lekker-review/references/agents/verifier.md

@@ -44,7 +44,13 @@ For `rule: "weakens-project-rule"`, use this dedicated path:
    `node <this prompt's directory>/../../scripts/project-rule-findings.mjs <finding.json> <CONTEXT_FILE>`.
    The validator requires the exact quote to exist in `baseProjectRules`; a
    missing base copy or rejected quote fails this check. Do not validate against
-   `projectRules`, which may already reflect the PR's weakened rules.
+   `projectRules`, which may already reflect the PR's weakened rules. The validator also
+   rejects a rule line that is still present unchanged in `projectRules` (the rule line was neither removed nor changed).
+   Exit 1 means `dropped`. Exit 2 means the validator could not run (for example
+   `baseProjectRules` is missing): check by hand that the exact quote appears in
+   `baseProjectRules` ONLY, never in `projectRules`; if `baseProjectRules` is not a string
+   or the quote is absent there, `dropped`. Otherwise keep the finding, say in `reasoning`
+   that the validator was unavailable, and set `validatorUnavailable: true`.
 
 Both checks pass -> `confirmed` at the finding's Important severity. Either
 check fails -> `dropped`. Do not downgrade a confirmed weakening.

package/adapters/claude/olko-github-pr/skills/lekker-review/scripts/project-rule-findings.mjs

@@ -41,9 +41,8 @@ const RECALLED_PATTERNS_HEADING = /^\s{0,3}#{1,6}\s+recalled patterns\s*$/gim
 // SKILL.md appends that heading at the end; an earlier one inside a rules file must not drop the rules after it.
 export function stripRecalledPatterns(text) {
   const source = String(text ?? '')
-  let cut = -1
-  for (const match of source.matchAll(RECALLED_PATTERNS_HEADING)) cut = match.index
-  return cut === -1 ? source : source.slice(0, cut)
+  const last = [...source.matchAll(RECALLED_PATTERNS_HEADING)].at(-1)
+  return last ? source.slice(0, last.index) : source
 }
 
 export function quoteAppearsIn(quote, projectRules) {
@@ -71,12 +70,54 @@ export function validateProjectRuleFinding(finding, projectRules) {
   return { ok: true, reason: 'quote found in projectRules' }
 }
 
-export function validateWeakenedProjectRuleFinding(finding, baseProjectRules) {
+// Still present means the whole rule block is unchanged; any wording change in the block
+// counts as possibly weakened and is left to the verifier.
+const LIST_MARKER = /^\s*([-+*]|\d+[.)])\s+/
+
+const indentOf = line => line.length - line.trimStart().length
+
+// A deeper marker or indented text belongs to its parent bullet, even after a blank line (loose list),
+// so an exception there must change the parent block.
+const isHeading = line => /^\s{0,3}#{1,6}\s/.test(line)
+const isListItem = line => LIST_MARKER.test(line)
+
+function startsNewBlock(line, current) {
+  if (isHeading(line)) return true
+  const [first] = current
+  if (first === undefined) return true
+  if (current[current.length - 1] === '') return !(isListItem(first) && indentOf(line) > indentOf(first))
+  if (!isListItem(line)) return false
+  if (isListItem(first)) return indentOf(line) <= indentOf(first)
+  return true
+}
+
+function ruleBlocks(text) {
+  const groups = stripRecalledPatterns(text).split(/\r?\n/).reduce((acc, line) => {
+    const current = acc[acc.length - 1]
+    if (line.trim() === '') return current === undefined || current.length === 0 ? acc : [...acc.slice(0, -1), [...current, '']]
+    if (current === undefined || startsNewBlock(line, current)) return [...acc, [line]]
+    return [...acc.slice(0, -1), [...current, line]]
+  }, [])
+  return groups
+    .map(lines => lines.map((line, i) => normalizeQuote(i === 0 ? line.replace(LIST_MARKER, '') : line)).filter(line => line !== '').join(' '))
+    .filter(block => block !== '')
+}
+
+export function ruleLineStillPresent(quote, baseProjectRules, projectRules) {
+  const needle = normalizeQuote(quote)
+  const baseHits = needle ? ruleBlocks(baseProjectRules).filter(block => block.includes(needle)) : []
+  if (baseHits.length === 0) return false
+  const prBlocks = new Set(ruleBlocks(projectRules))
+  return baseHits.some(block => prBlocks.has(block))
+}
+
+// `unavailable` marks a missing input, not a judgement on the finding: the CLI maps it to exit 2.
+export function validateWeakenedProjectRuleFinding(finding, baseProjectRules, projectRules) {
   if (finding?.rule !== 'weakens-project-rule') {
     return { ok: true, reason: 'not a weakened project rule' }
   }
   if (typeof baseProjectRules !== 'string') {
-    return { ok: false, reason: 'baseProjectRules unavailable' }
+    return { ok: false, unavailable: true, reason: 'baseProjectRules unavailable' }
   }
   if (typeof finding.ruleQuote !== 'string' || finding.ruleQuote.trim() === '') {
     return { ok: false, reason: 'missing ruleQuote: quote the removed project rule' }
@@ -84,6 +125,9 @@ export function validateWeakenedProjectRuleFinding(finding, baseProjectRules) {
   if (!quoteAppearsIn(finding.ruleQuote, baseProjectRules)) {
     return { ok: false, reason: 'ruleQuote not found in baseProjectRules' }
   }
+  if (typeof projectRules === 'string' && ruleLineStillPresent(finding.ruleQuote, baseProjectRules, projectRules)) {
+    return { ok: false, reason: 'rule still present in projectRules' }
+  }
   return { ok: true, reason: 'quote found in baseProjectRules' }
 }
 
@@ -97,8 +141,9 @@ function main(argv) {
     const finding = JSON.parse(readFileSync(findingPath, 'utf8'))
     const context = JSON.parse(readFileSync(contextPath, 'utf8'))
     if (finding?.rule === 'weakens-project-rule') {
-      const result = validateWeakenedProjectRuleFinding(finding, context.baseProjectRules)
+      const result = validateWeakenedProjectRuleFinding(finding, context.baseProjectRules, context.projectRules)
       console.log(JSON.stringify(result))
+      if (result.unavailable) return 2
       return result.ok ? 0 : 1
     }
     // Base-branch rules are authoritative; PR-tree rules only when no base was resolved.

package/adapters/claude/olko-github-pr/skills/lekker-review/scripts/selftest.mjs

@@ -52,11 +52,13 @@ const preamble = [
   "const SEVERITY_RANK = { observation: 0, idiomatic: 1, important: 2, critical: 3 }",
   // hardRuleCorroborated is likewise gone from the current file and kept in this
   // list for the same reason: an older workflow.js calls it from isHardRule.
-  ...['titleTokens', 'sameIssue', 'nearbyLines', 'spanWithinWindow', 'hardRuleCorroborated',
+  ...['titleTokens', 'normalizeRuleQuote', 'weakenedRuleSeverity', 'sameIssue', 'nearbyLines', 'spanWithinWindow', 'hardRuleCorroborated',
       'isHardRule', 'longest', 'mergeFindings', 'dedup', 'shouldVerify', 'isProveAttempt', 'countProveAttempt'].map(n => {
         // countProveAttempt is called directly by the checks, so its stub returns NaN and the
         // checks FAIL with a diff instead of the run crashing on an older workflow.js.
         try { return lift(n) } catch {
+          if (n === 'normalizeRuleQuote') return "function normalizeRuleQuote() { return 'absent from this workflow.js' }"
+          if (n === 'weakenedRuleSeverity') return "function weakenedRuleSeverity() { return 'absent from this workflow.js' }"
           return n === 'countProveAttempt'
             ? 'function countProveAttempt() { return NaN }'
             : `function ${n}() { throw new Error('${n} absent from this workflow.js') }`
@@ -64,8 +66,8 @@ const preamble = [
       }),
 ].join('\n')
 
-const { dedup, isHardRule, shouldVerify, sameIssue, isProveAttempt, countProveAttempt } =
-  new Function(preamble + '\nreturn { dedup, isHardRule, shouldVerify, sameIssue, isProveAttempt, countProveAttempt }')()
+const { dedup, isHardRule, shouldVerify, sameIssue, isProveAttempt, countProveAttempt, normalizeRuleQuote, weakenedRuleSeverity } =
+  new Function(preamble + '\nreturn { dedup, isHardRule, shouldVerify, sameIssue, isProveAttempt, countProveAttempt, normalizeRuleQuote, weakenedRuleSeverity }')()
 
 let failed = 0
 function check(name, actual, expected) {
@@ -700,7 +702,7 @@ console.log('\nproject rules: PROJECT:<slug> findings must quote a rule that exi
 const { spawnSync: spawnPr } = await import('node:child_process')
 const { mkdtempSync: mkPr, cpSync: cpPr, readFileSync: rdPr, rmSync: rmPr, symlinkSync: syPr, writeFileSync: wfPr } = await import('node:fs')
 const { tmpdir: tmpPr } = await import('node:os')
-const { validateProjectRuleFinding, validateWeakenedProjectRuleFinding, isProjectRuleTag } =
+const { validateProjectRuleFinding, validateWeakenedProjectRuleFinding, isProjectRuleTag, normalizeQuote } =
   await import('./project-rule-findings.mjs')
 
 const fixtureDir = join(SKILL, 'scripts', 'fixtures', 'project-rules')
@@ -740,6 +742,65 @@ check('rejects a weakened rule quote absent from baseProjectRules',
   validateWeakenedProjectRuleFinding(weakenedFinding, 'NEVER call eval.').ok, false)
 check('rejects a weakened rule when baseProjectRules is unavailable',
   validateWeakenedProjectRuleFinding(weakenedFinding, undefined).ok, false)
+check('rejects a weakened rule whose quote is still in projectRules',
+  validateWeakenedProjectRuleFinding(weakenedFinding, planted, planted).ok, false)
+check('accepts a weakened rule whose quote is gone from projectRules',
+  validateWeakenedProjectRuleFinding(weakenedFinding, planted, 'nothing here').ok, true)
+const evalBase = '- NEVER call eval in src'
+const evalFinding = prFinding('weakens-project-rule', 'NEVER call eval in src')
+check('accepts a weakening that appends an exception to the rule line',
+  validateWeakenedProjectRuleFinding(evalFinding, evalBase, '- NEVER call eval in src unless input is trusted').ok, true)
+check('accepts a weakening that adds a period and an Exception sentence on the same line',
+  validateWeakenedProjectRuleFinding(evalFinding, evalBase, '- NEVER call eval in src. Exception: trusted input.').ok, true)
+check('rejects a weakened rule whose line is unchanged among other lines',
+  validateWeakenedProjectRuleFinding(evalFinding, evalBase, '# Rules\n- NEVER call eval in src\n- Be kind').reason, 'rule still present in projectRules')
+const wrappedBase = '- After ANY catalog change, run build and commit\n  the result'
+const wrappedFinding = prFinding('weakens-project-rule', 'After ANY catalog change, run build and commit the result')
+check('accepts a weakening appended to the last line of a wrapped rule',
+  validateWeakenedProjectRuleFinding(wrappedFinding, wrappedBase, '- After ANY catalog change, run build and commit\n  the result, except docs-only changes').ok, true)
+check('rejects an unchanged wrapped rule',
+  validateWeakenedProjectRuleFinding(wrappedFinding, wrappedBase, wrappedBase).reason, 'rule still present in projectRules')
+check('rejects a wrapped rule re-wrapped at a different column',
+  validateWeakenedProjectRuleFinding(wrappedFinding, wrappedBase, '- After ANY catalog change, run build\n  and commit the result').reason, 'rule still present in projectRules')
+check('rejects a rule whose bullet marker changed to an asterisk',
+  validateWeakenedProjectRuleFinding(evalFinding, evalBase, '* NEVER call eval in src').reason, 'rule still present in projectRules')
+check('rejects an unchanged numbered rule',
+  validateWeakenedProjectRuleFinding(evalFinding, '1. NEVER call eval in src', '1. NEVER call eval in src').reason, 'rule still present in projectRules')
+check('rejects a bullet rule renumbered in the PR',
+  validateWeakenedProjectRuleFinding(evalFinding, evalBase, '1. NEVER call eval in src').reason, 'rule still present in projectRules')
+check('accepts a weakening that adds a prefix qualifier before the quote',
+  validateWeakenedProjectRuleFinding(prFinding('weakens-project-rule', 'NEVER force-push'), '- NEVER force-push', '- Except on your own branch, NEVER force-push').ok, true)
+check('accepts a weakening added on a new continuation line of the same bullet',
+  validateWeakenedProjectRuleFinding(wrappedFinding, wrappedBase + '.', wrappedBase + '.\n  Docs-only changes are exempt.').ok, true)
+check('rejects a single-line rule re-wrapped over two lines',
+  validateWeakenedProjectRuleFinding(wrappedFinding, '- After ANY catalog change, run build and commit the result', wrappedBase).reason, 'rule still present in projectRules')
+check('rejects a rule moved to another section unchanged',
+  validateWeakenedProjectRuleFinding(evalFinding, '# A\n' + evalBase + '\n# B\n- x', '# B\n- x\n# A\n' + evalBase).reason, 'rule still present in projectRules')
+check('accepts an exception appended to a two-line blockquote rule',
+  validateWeakenedProjectRuleFinding(prFinding('weakens-project-rule', 'NEVER force-push to main or release branches.'), '> NEVER force-push to main\n> or release branches.', '> NEVER force-push to main\n> or release branches. Exception: your own branch.').ok, true)
+check('accepts an exception added as an indented sub-bullet',
+  validateWeakenedProjectRuleFinding(prFinding('weakens-project-rule', 'NEVER force-push'), '- NEVER force-push', '- NEVER force-push\n  - except on your own branch').ok, true)
+check('accepts a parent bullet narrowed above an unchanged sub-bullet',
+  validateWeakenedProjectRuleFinding(prFinding('weakens-project-rule', 'NEVER call eval'), '- In src:\n  - NEVER call eval', '- In src/legacy only:\n  - NEVER call eval').ok, true)
+check('accepts a quote spanning two base bullets when the second gains an exception',
+  validateWeakenedProjectRuleFinding(prFinding('weakens-project-rule', 'NEVER force-push\n- NEVER delete main'), '- NEVER force-push\n- NEVER delete main', '- NEVER force-push\n- NEVER delete main unless asked').ok, true)
+check('rejects an unchanged rule with an unchanged nested sub-bullet',
+  validateWeakenedProjectRuleFinding(prFinding('weakens-project-rule', 'NEVER force-push'), '- NEVER force-push\n  - on shared branches', '- NEVER force-push\n  - on shared branches').reason, 'rule still present in projectRules')
+check('accepts an exception sub-bullet added after a blank line in a loose list',
+  validateWeakenedProjectRuleFinding(prFinding('weakens-project-rule', 'NEVER force-push'), '- NEVER force-push', '- NEVER force-push\n\n  - except on your own branch').ok, true)
+check('accepts an indented exception paragraph added after a blank line',
+  validateWeakenedProjectRuleFinding(prFinding('weakens-project-rule', 'NEVER force-push'), '- NEVER force-push', '- NEVER force-push\n\n  Except on your own branch.').ok, true)
+const introBase = 'These apply everywhere.\n- In domain code:\n  - NEVER mutate state'
+check('accepts a narrowed parent bullet under an intro paragraph',
+  validateWeakenedProjectRuleFinding(prFinding('weakens-project-rule', 'NEVER mutate state'), introBase, 'These apply everywhere.\n- In domain code, except scripts:\n  - NEVER mutate state').ok, true)
+check('accepts an exception sibling added under a parent bullet below an intro paragraph',
+  validateWeakenedProjectRuleFinding(prFinding('weakens-project-rule', 'NEVER mutate state'), introBase, introBase + '\n  - Mutation is fine in reducers').ok, true)
+check('rejects an unchanged loose-list rule with an unchanged indented paragraph',
+  validateWeakenedProjectRuleFinding(prFinding('weakens-project-rule', 'NEVER force-push'), '- NEVER force-push\n\n  on shared branches', '- NEVER force-push\n\n  on shared branches').reason, 'rule still present in projectRules')
+check('rejects unchanged blank-separated sibling bullets when another bullet is edited',
+  validateWeakenedProjectRuleFinding(prFinding('weakens-project-rule', 'NEVER force-push'), '- NEVER force-push\n\n- NEVER call eval', '- NEVER force-push\n\n- NEVER call eval in src').reason, 'rule still present in projectRules')
+check('rejects an unchanged bullet under a lead-in when a sibling is edited',
+  validateWeakenedProjectRuleFinding(prFinding('weakens-project-rule', 'NEVER force-push'), 'Rules:\n- NEVER force-push\n- NEVER call eval', 'Rules:\n- NEVER force-push\n- NEVER call eval, except tests').reason, 'rule still present in projectRules')
 check('rejects a weakened rule with no quote',
   validateWeakenedProjectRuleFinding({ rule: 'weakens-project-rule' }, planted).ok, false)
 const verifierInstructions = rdPr(join(SKILL, 'references', 'agents', 'verifier.md'), 'utf8')
@@ -772,6 +833,25 @@ const quoteA = { file: 'src/total.js', line: 2, title: 'Missing null check on to
 const quoteB = { ...quoteA, ruleQuote: 'ALWAYS validate total before use.' }
 check('two different quotes of one PROJECT rule are not sameIssue', sameIssue(quoteA, quoteB), false)
 check('the same quote of one PROJECT rule is still sameIssue', sameIssue(quoteA, { ...quoteA }), true)
+check('the same slug with quotes equal after normalisation is sameIssue',
+  sameIssue(quoteA, { ...quoteA, ruleQuote: '  never   SKIP the null check on total.  ' }), true)
+const slugB = { ...quoteA, rule: 'PROJECT:null-total-guard', ruleQuote: '**Never skip** the null check on total.' }
+check('two PROJECT slugs with one quote modulo case, whitespace and emphasis are sameIssue', sameIssue(quoteA, slugB), true)
+const [mergedSlugs] = dedup([{ ...quoteA, severity: 'important' }, { ...slugB, severity: 'important' }])
+check('different-slug same-quote findings merge into one finding that keeps rule and quote',
+  [dedup([{ ...quoteA, severity: 'important' }, { ...slugB, severity: 'important' }]).length, mergedSlugs.rule, typeof mergedSlugs.ruleQuote],
+  [1, 'PROJECT:no-null-total', 'string'])
+check('different-slug different-quote findings stay separate',
+  sameIssue(quoteA, { ...slugB, ruleQuote: 'ALWAYS validate total before use.' }), false)
+const quoteSamples = ['NEVER call `console.log` in src/.', '> **Never** skip\n  the   check', '- Use _early_ returns', '## Heading rule text']
+check('workflow normalizeRuleQuote agrees with the validator normalizeQuote',
+  quoteSamples.map(q => normalizeRuleQuote(q)), quoteSamples.map(q => normalizeQuote(q)))
+check('quotes differing only by trailing punctuation are not sameIssue',
+  sameIssue(quoteA, { ...quoteA, ruleQuote: 'NEVER skip the null check on total' }), false)
+console.log('\nworkflow: a confirmed weakened-rule finding is always Important')
+check('critical from the lens becomes important for weakens-project-rule',
+  weakenedRuleSeverity({ rule: 'weakens-project-rule' }, 'critical'), 'important')
+check('other rules keep the severity', weakenedRuleSeverity({ rule: 'TS-1' }, 'critical'), 'critical')
 
 // Prompt guard: every lens that reads projectRules is told to raise the tag.
 const lensFiles = ['quality', 'implementation', 'simplification', 'conventions', 'test-quality']
@@ -787,9 +867,11 @@ function liftBlock(name) {
   if (!m) throw new Error(`selftest: const ${name} not found in workflow.js`)
   return m[0]
 }
+// An older workflow.js lacks these constants; fall back so the checks FAIL instead of the suite crashing.
+const liftBlockOr = name => { try { return liftBlock(name) } catch { return `const ${name} = ''\n` } }
 const buildPrompt = new Function(
   'dim', 'SUPPRESSED', 'prevSha',
-  [liftBlock('PROJECT_RULE_DIMENSIONS'), liftBlock('PROJECT_RULE_INSTRUCTION'), liftConst('BUG_CLASS_INSTRUCTION'),
+  [liftBlockOr('PROJECT_RULE_DIMENSIONS'), liftBlockOr('PROJECT_RULE_INSTRUCTION'), liftConst('BUG_CLASS_INSTRUCTION'),
     `const targetMetadata = '{}', promptDir = 'p', repoSlug = 'o/r', prNumber = 1, prUrl = 'u',
        diffFile = 'd', contextFile = 'c', wtDisplay = 'w'`,
     lift('reviewPrompt'), 'return reviewPrompt(dim)'].join('\n'),
@@ -846,6 +928,12 @@ check('validator accepts a weakened-rule quote found in baseProjectRules',
 check('validator rejects a weakened-rule quote found only in projectRules',
   runV(weakenedFile, addedCtx), 1)
 wfPr(join(crashDir, 'rej.json'), JSON.stringify({ rule: 'PROJECT:no-eval', ruleQuote: 'NEVER call eval anywhere in code' }))
+const noBaseCtx = join(crashDir, 'nobase.json')
+wfPr(noBaseCtx, JSON.stringify({ projectRules: 'nothing here' }))
+check('exit 2 on a weakened finding when baseProjectRules is missing', runV(weakenedFile, noBaseCtx), 2)
+const stillCtx = join(crashDir, 'still.json')
+wfPr(stillCtx, JSON.stringify({ projectRules: 'NEVER call console.log in src/.', baseProjectRules: 'NEVER call console.log in src/.' }))
+check('exit 1 on a weakened finding whose rule is still in projectRules', runV(weakenedFile, stillCtx), 1)
 check('exit 1 on a rejected finding', runV(join(crashDir, 'rej.json'), okCtx), 1)
 const symlinkValidator = join(crashDir, 'project-rule-findings.mjs')
 syPr(join(SKILL, 'scripts', 'project-rule-findings.mjs'), symlinkValidator)

package/adapters/claude/olko-github-pr/skills/lekker-review/scripts/setup-worktree.sh

@@ -157,24 +157,33 @@ if [[ "${LEKKER_RULES_ONLY:-}" == "1" ]]; then
         if git -C "$REPO_ROOT" fetch origin "+refs/heads/${PR_BRANCH}:refs/remotes/origin/${PR_BRANCH}" 2>/dev/null; then
             RULES_REF="origin/$PR_BRANCH"
         elif git -C "$REPO_ROOT" fetch origin "$PR_BRANCH" 2>/dev/null; then
-            RULES_REF=FETCH_HEAD
+            # The base fetch below overwrites FETCH_HEAD, so pin the PR tip now.
+            RULES_REF="$(git -C "$REPO_ROOT" rev-parse FETCH_HEAD)"
         else
             printf 'ERROR: could not fetch PR branch %s for rules-only scan\n' "$PR_BRANCH" >&2
             exit 1
         fi
     fi
+    # Base rules are best effort: a failure here keeps projectRules and nulls baseProjectRules,
+    # because the base copy only hardens validation and must not abort the scan.
+    RULES_BASE_SHA=""
     if [[ -n "${LEKKER_BASE_REF:-}" ]]; then
+        BASE_FETCH_OK=1
         if [[ -z "$LOCAL_REPO" && "$LEKKER_BASE_REF" == origin/* ]]; then
             BASE_BRANCH="${LEKKER_BASE_REF#origin/}"
-            if ! git -C "$REPO_ROOT" fetch origin \
-                "+refs/heads/${BASE_BRANCH}:refs/remotes/origin/${BASE_BRANCH}" 2>/dev/null; then
-                printf 'ERROR: could not fetch base ref %s for rules-only scan\n' "$LEKKER_BASE_REF" >&2
-                exit 1
-            fi
+            git -C "$REPO_ROOT" fetch origin \
+                "+refs/heads/${BASE_BRANCH}:refs/remotes/origin/${BASE_BRANCH}" 2>/dev/null || BASE_FETCH_OK=0
         fi
-        if ! git -C "$REPO_ROOT" rev-parse --verify -q "${LEKKER_BASE_REF}^{commit}" >/dev/null; then
-            printf 'ERROR: base ref %s does not resolve for rules-only scan\n' "$LEKKER_BASE_REF" >&2
-            exit 1
+        # Fork point, as in full mode: the base tip may carry rules added after the PR branched.
+        if [[ "$BASE_FETCH_OK" == "1" ]] \
+            && git -C "$REPO_ROOT" rev-parse --verify -q "${LEKKER_BASE_REF}^{commit}" >/dev/null; then
+            RULES_BASE_SHA="$(git -C "$REPO_ROOT" merge-base "$LEKKER_BASE_REF" "$RULES_REF" 2>/dev/null || true)"
+            # A fork older than the shallow clone depth has no common ancestor until history is deepened.
+            if [[ -z "$RULES_BASE_SHA" ]] \
+                && [[ "$(git -C "$REPO_ROOT" rev-parse --is-shallow-repository 2>/dev/null)" == "true" ]]; then
+                git -C "$REPO_ROOT" fetch -q --deepen=200 origin 2>/dev/null || true
+                RULES_BASE_SHA="$(git -C "$REPO_ROOT" merge-base "$LEKKER_BASE_REF" "$RULES_REF" 2>/dev/null || true)"
+            fi
         fi
     fi
     RULES_SOURCE="/tmp/lekker-rules-source-$$"
@@ -184,17 +193,19 @@ if [[ "${LEKKER_RULES_ONLY:-}" == "1" ]]; then
     BASE_PROJECT_RULES=""
     HAVE_BASE_RULES=0
     if [[ -n "${LEKKER_BASE_REF:-}" ]]; then
-        if BASE_PROJECT_RULES="$(collect_project_rules_at_ref "$REPO_ROOT" "$LEKKER_BASE_REF")"; then
+        if [[ -n "$RULES_BASE_SHA" ]] \
+            && BASE_PROJECT_RULES="$(collect_project_rules_at_ref "$REPO_ROOT" "$RULES_BASE_SHA")"; then
             HAVE_BASE_RULES=1
         else
             BASE_PROJECT_RULES=""
             NOTES="${NOTES}base-rules-unavailable;"
         fi
     fi
-    python3 - "$OUT_JSON" "$PROJECT_RULES" "$BASE_PROJECT_RULES" "$HAVE_BASE_RULES" <<'PYEOF'
+    python3 - "$OUT_JSON" "$PROJECT_RULES" "$BASE_PROJECT_RULES" "$HAVE_BASE_RULES" "$NOTES" <<'PYEOF'
 import json, sys
 out = {"projectRules": sys.argv[2]}
 out["baseProjectRules"] = sys.argv[3] if sys.argv[4] == "1" else None
+out["notes"] = sys.argv[5]
 with open(sys.argv[1], "w") as f:
     json.dump(out, f, indent=2)
 PYEOF

package/adapters/claude/olko-github-pr/skills/lekker-review/scripts/validate-lines.mjs

@@ -75,6 +75,8 @@ export function loadDedup(workflowPath = join(SKILL, 'workflow.js')) {
     liftConst('HARD_RULES', 'const HARD_RULES = new Set()'),
     liftConst('SAME_ISSUE_LINE_WINDOW', 'const SAME_ISSUE_LINE_WINDOW = 30'),
     liftConst('SEVERITY_RANK', 'const SEVERITY_RANK = { critical: 3, important: 2, observation: 1, idiomatic: 0 }'),
+    // Absent from an older workflow.js, whose sameIssue does not call it.
+    (() => { try { return lift('normalizeRuleQuote') } catch { return '' } })(),
     ...['titleTokens', 'sameIssue', 'nearbyLines', 'spanWithinWindow',
         'isHardRule', 'longest', 'mergeFindings', 'dedup'].map(lift),
   ].join('\n')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@olegkoval/agent-skills",
-  "version": "1.71.0",
+  "version": "1.71.1",
   "private": false,
   "publishConfig": {
     "access": "public"

package/plugins/olko-apple-kit/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-apple-kit",
   "description": "Build and ship Apple platform apps: macOS menubar apps, App Store submissions.",
-  "version": "1.71.0",
+  "version": "1.71.1",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-creative/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-creative",
   "description": "Creative and personal projects: photo galleries, music players, listings, wiki editing.",
-  "version": "1.71.0",
+  "version": "1.71.1",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-garmin-kit/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-garmin-kit",
   "description": "Build, test and publish Garmin Connect IQ watch faces.",
-  "version": "1.71.0",
+  "version": "1.71.1",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-git-tools/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-git-tools",
   "description": "Everyday git and GitHub CLI operations: conventional commits, branch hygiene.",
-  "version": "1.71.0",
+  "version": "1.71.1",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-github-pr/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-github-pr",
   "description": "Drive GitHub pull requests to merge-ready: review-bot loops, CI fixes, descriptions, dependency triage.",
-  "version": "1.71.0",
+  "version": "1.71.1",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-github-pr/skills/lekker-review/SKILL.md

@@ -475,7 +475,7 @@ LEKKER_RULES_ONLY=1 LEKKER_BASE_REF=origin/<BASE_BRANCH> \
 ```
 
 Read `projectRules` from `rules.json` into `context.json`. This archive-only
-mode fetches the PR base for `baseProjectRules` and does not run static checks.
+mode fetches the PR base and reads `baseProjectRules` at the merge base with the PR branch (as full mode does), not at the base tip. If the base cannot be fetched, resolved or merge-based, `baseProjectRules` is `null` and `notes` carries `base-rules-unavailable`; the scan still succeeds. It does not run static checks.
 
 Run via Bash with `run_in_background`:
 

package/plugins/olko-github-pr/skills/lekker-review/references/agents/verifier.md

@@ -44,7 +44,13 @@ For `rule: "weakens-project-rule"`, use this dedicated path:
    `node <this prompt's directory>/../../scripts/project-rule-findings.mjs <finding.json> <CONTEXT_FILE>`.
    The validator requires the exact quote to exist in `baseProjectRules`; a
    missing base copy or rejected quote fails this check. Do not validate against
-   `projectRules`, which may already reflect the PR's weakened rules.
+   `projectRules`, which may already reflect the PR's weakened rules. The validator also
+   rejects a rule line that is still present unchanged in `projectRules` (the rule line was neither removed nor changed).
+   Exit 1 means `dropped`. Exit 2 means the validator could not run (for example
+   `baseProjectRules` is missing): check by hand that the exact quote appears in
+   `baseProjectRules` ONLY, never in `projectRules`; if `baseProjectRules` is not a string
+   or the quote is absent there, `dropped`. Otherwise keep the finding, say in `reasoning`
+   that the validator was unavailable, and set `validatorUnavailable: true`.
 
 Both checks pass -> `confirmed` at the finding's Important severity. Either
 check fails -> `dropped`. Do not downgrade a confirmed weakening.

package/plugins/olko-github-pr/skills/lekker-review/scripts/project-rule-findings.mjs

@@ -41,9 +41,8 @@ const RECALLED_PATTERNS_HEADING = /^\s{0,3}#{1,6}\s+recalled patterns\s*$/gim
 // SKILL.md appends that heading at the end; an earlier one inside a rules file must not drop the rules after it.
 export function stripRecalledPatterns(text) {
   const source = String(text ?? '')
-  let cut = -1
-  for (const match of source.matchAll(RECALLED_PATTERNS_HEADING)) cut = match.index
-  return cut === -1 ? source : source.slice(0, cut)
+  const last = [...source.matchAll(RECALLED_PATTERNS_HEADING)].at(-1)
+  return last ? source.slice(0, last.index) : source
 }
 
 export function quoteAppearsIn(quote, projectRules) {
@@ -71,12 +70,54 @@ export function validateProjectRuleFinding(finding, projectRules) {
   return { ok: true, reason: 'quote found in projectRules' }
 }
 
-export function validateWeakenedProjectRuleFinding(finding, baseProjectRules) {
+// Still present means the whole rule block is unchanged; any wording change in the block
+// counts as possibly weakened and is left to the verifier.
+const LIST_MARKER = /^\s*([-+*]|\d+[.)])\s+/
+
+const indentOf = line => line.length - line.trimStart().length
+
+// A deeper marker or indented text belongs to its parent bullet, even after a blank line (loose list),
+// so an exception there must change the parent block.
+const isHeading = line => /^\s{0,3}#{1,6}\s/.test(line)
+const isListItem = line => LIST_MARKER.test(line)
+
+function startsNewBlock(line, current) {
+  if (isHeading(line)) return true
+  const [first] = current
+  if (first === undefined) return true
+  if (current[current.length - 1] === '') return !(isListItem(first) && indentOf(line) > indentOf(first))
+  if (!isListItem(line)) return false
+  if (isListItem(first)) return indentOf(line) <= indentOf(first)
+  return true
+}
+
+function ruleBlocks(text) {
+  const groups = stripRecalledPatterns(text).split(/\r?\n/).reduce((acc, line) => {
+    const current = acc[acc.length - 1]
+    if (line.trim() === '') return current === undefined || current.length === 0 ? acc : [...acc.slice(0, -1), [...current, '']]
+    if (current === undefined || startsNewBlock(line, current)) return [...acc, [line]]
+    return [...acc.slice(0, -1), [...current, line]]
+  }, [])
+  return groups
+    .map(lines => lines.map((line, i) => normalizeQuote(i === 0 ? line.replace(LIST_MARKER, '') : line)).filter(line => line !== '').join(' '))
+    .filter(block => block !== '')
+}
+
+export function ruleLineStillPresent(quote, baseProjectRules, projectRules) {
+  const needle = normalizeQuote(quote)
+  const baseHits = needle ? ruleBlocks(baseProjectRules).filter(block => block.includes(needle)) : []
+  if (baseHits.length === 0) return false
+  const prBlocks = new Set(ruleBlocks(projectRules))
+  return baseHits.some(block => prBlocks.has(block))
+}
+
+// `unavailable` marks a missing input, not a judgement on the finding: the CLI maps it to exit 2.
+export function validateWeakenedProjectRuleFinding(finding, baseProjectRules, projectRules) {
   if (finding?.rule !== 'weakens-project-rule') {
     return { ok: true, reason: 'not a weakened project rule' }
   }
   if (typeof baseProjectRules !== 'string') {
-    return { ok: false, reason: 'baseProjectRules unavailable' }
+    return { ok: false, unavailable: true, reason: 'baseProjectRules unavailable' }
   }
   if (typeof finding.ruleQuote !== 'string' || finding.ruleQuote.trim() === '') {
     return { ok: false, reason: 'missing ruleQuote: quote the removed project rule' }
@@ -84,6 +125,9 @@ export function validateWeakenedProjectRuleFinding(finding, baseProjectRules) {
   if (!quoteAppearsIn(finding.ruleQuote, baseProjectRules)) {
     return { ok: false, reason: 'ruleQuote not found in baseProjectRules' }
   }
+  if (typeof projectRules === 'string' && ruleLineStillPresent(finding.ruleQuote, baseProjectRules, projectRules)) {
+    return { ok: false, reason: 'rule still present in projectRules' }
+  }
   return { ok: true, reason: 'quote found in baseProjectRules' }
 }
 
@@ -97,8 +141,9 @@ function main(argv) {
     const finding = JSON.parse(readFileSync(findingPath, 'utf8'))
     const context = JSON.parse(readFileSync(contextPath, 'utf8'))
     if (finding?.rule === 'weakens-project-rule') {
-      const result = validateWeakenedProjectRuleFinding(finding, context.baseProjectRules)
+      const result = validateWeakenedProjectRuleFinding(finding, context.baseProjectRules, context.projectRules)
       console.log(JSON.stringify(result))
+      if (result.unavailable) return 2
       return result.ok ? 0 : 1
     }
     // Base-branch rules are authoritative; PR-tree rules only when no base was resolved.

package/plugins/olko-github-pr/skills/lekker-review/scripts/selftest.mjs

@@ -52,11 +52,13 @@ const preamble = [
   "const SEVERITY_RANK = { observation: 0, idiomatic: 1, important: 2, critical: 3 }",
   // hardRuleCorroborated is likewise gone from the current file and kept in this
   // list for the same reason: an older workflow.js calls it from isHardRule.
-  ...['titleTokens', 'sameIssue', 'nearbyLines', 'spanWithinWindow', 'hardRuleCorroborated',
+  ...['titleTokens', 'normalizeRuleQuote', 'weakenedRuleSeverity', 'sameIssue', 'nearbyLines', 'spanWithinWindow', 'hardRuleCorroborated',
       'isHardRule', 'longest', 'mergeFindings', 'dedup', 'shouldVerify', 'isProveAttempt', 'countProveAttempt'].map(n => {
         // countProveAttempt is called directly by the checks, so its stub returns NaN and the
         // checks FAIL with a diff instead of the run crashing on an older workflow.js.
         try { return lift(n) } catch {
+          if (n === 'normalizeRuleQuote') return "function normalizeRuleQuote() { return 'absent from this workflow.js' }"
+          if (n === 'weakenedRuleSeverity') return "function weakenedRuleSeverity() { return 'absent from this workflow.js' }"
           return n === 'countProveAttempt'
             ? 'function countProveAttempt() { return NaN }'
             : `function ${n}() { throw new Error('${n} absent from this workflow.js') }`
@@ -64,8 +66,8 @@ const preamble = [
       }),
 ].join('\n')
 
-const { dedup, isHardRule, shouldVerify, sameIssue, isProveAttempt, countProveAttempt } =
-  new Function(preamble + '\nreturn { dedup, isHardRule, shouldVerify, sameIssue, isProveAttempt, countProveAttempt }')()
+const { dedup, isHardRule, shouldVerify, sameIssue, isProveAttempt, countProveAttempt, normalizeRuleQuote, weakenedRuleSeverity } =
+  new Function(preamble + '\nreturn { dedup, isHardRule, shouldVerify, sameIssue, isProveAttempt, countProveAttempt, normalizeRuleQuote, weakenedRuleSeverity }')()
 
 let failed = 0
 function check(name, actual, expected) {
@@ -700,7 +702,7 @@ console.log('\nproject rules: PROJECT:<slug> findings must quote a rule that exi
 const { spawnSync: spawnPr } = await import('node:child_process')
 const { mkdtempSync: mkPr, cpSync: cpPr, readFileSync: rdPr, rmSync: rmPr, symlinkSync: syPr, writeFileSync: wfPr } = await import('node:fs')
 const { tmpdir: tmpPr } = await import('node:os')
-const { validateProjectRuleFinding, validateWeakenedProjectRuleFinding, isProjectRuleTag } =
+const { validateProjectRuleFinding, validateWeakenedProjectRuleFinding, isProjectRuleTag, normalizeQuote } =
   await import('./project-rule-findings.mjs')
 
 const fixtureDir = join(SKILL, 'scripts', 'fixtures', 'project-rules')
@@ -740,6 +742,65 @@ check('rejects a weakened rule quote absent from baseProjectRules',
   validateWeakenedProjectRuleFinding(weakenedFinding, 'NEVER call eval.').ok, false)
 check('rejects a weakened rule when baseProjectRules is unavailable',
   validateWeakenedProjectRuleFinding(weakenedFinding, undefined).ok, false)
+check('rejects a weakened rule whose quote is still in projectRules',
+  validateWeakenedProjectRuleFinding(weakenedFinding, planted, planted).ok, false)
+check('accepts a weakened rule whose quote is gone from projectRules',
+  validateWeakenedProjectRuleFinding(weakenedFinding, planted, 'nothing here').ok, true)
+const evalBase = '- NEVER call eval in src'
+const evalFinding = prFinding('weakens-project-rule', 'NEVER call eval in src')
+check('accepts a weakening that appends an exception to the rule line',
+  validateWeakenedProjectRuleFinding(evalFinding, evalBase, '- NEVER call eval in src unless input is trusted').ok, true)
+check('accepts a weakening that adds a period and an Exception sentence on the same line',
+  validateWeakenedProjectRuleFinding(evalFinding, evalBase, '- NEVER call eval in src. Exception: trusted input.').ok, true)
+check('rejects a weakened rule whose line is unchanged among other lines',
+  validateWeakenedProjectRuleFinding(evalFinding, evalBase, '# Rules\n- NEVER call eval in src\n- Be kind').reason, 'rule still present in projectRules')
+const wrappedBase = '- After ANY catalog change, run build and commit\n  the result'
+const wrappedFinding = prFinding('weakens-project-rule', 'After ANY catalog change, run build and commit the result')
+check('accepts a weakening appended to the last line of a wrapped rule',
+  validateWeakenedProjectRuleFinding(wrappedFinding, wrappedBase, '- After ANY catalog change, run build and commit\n  the result, except docs-only changes').ok, true)
+check('rejects an unchanged wrapped rule',
+  validateWeakenedProjectRuleFinding(wrappedFinding, wrappedBase, wrappedBase).reason, 'rule still present in projectRules')
+check('rejects a wrapped rule re-wrapped at a different column',
+  validateWeakenedProjectRuleFinding(wrappedFinding, wrappedBase, '- After ANY catalog change, run build\n  and commit the result').reason, 'rule still present in projectRules')
+check('rejects a rule whose bullet marker changed to an asterisk',
+  validateWeakenedProjectRuleFinding(evalFinding, evalBase, '* NEVER call eval in src').reason, 'rule still present in projectRules')
+check('rejects an unchanged numbered rule',
+  validateWeakenedProjectRuleFinding(evalFinding, '1. NEVER call eval in src', '1. NEVER call eval in src').reason, 'rule still present in projectRules')
+check('rejects a bullet rule renumbered in the PR',
+  validateWeakenedProjectRuleFinding(evalFinding, evalBase, '1. NEVER call eval in src').reason, 'rule still present in projectRules')
+check('accepts a weakening that adds a prefix qualifier before the quote',
+  validateWeakenedProjectRuleFinding(prFinding('weakens-project-rule', 'NEVER force-push'), '- NEVER force-push', '- Except on your own branch, NEVER force-push').ok, true)
+check('accepts a weakening added on a new continuation line of the same bullet',
+  validateWeakenedProjectRuleFinding(wrappedFinding, wrappedBase + '.', wrappedBase + '.\n  Docs-only changes are exempt.').ok, true)
+check('rejects a single-line rule re-wrapped over two lines',
+  validateWeakenedProjectRuleFinding(wrappedFinding, '- After ANY catalog change, run build and commit the result', wrappedBase).reason, 'rule still present in projectRules')
+check('rejects a rule moved to another section unchanged',
+  validateWeakenedProjectRuleFinding(evalFinding, '# A\n' + evalBase + '\n# B\n- x', '# B\n- x\n# A\n' + evalBase).reason, 'rule still present in projectRules')
+check('accepts an exception appended to a two-line blockquote rule',
+  validateWeakenedProjectRuleFinding(prFinding('weakens-project-rule', 'NEVER force-push to main or release branches.'), '> NEVER force-push to main\n> or release branches.', '> NEVER force-push to main\n> or release branches. Exception: your own branch.').ok, true)
+check('accepts an exception added as an indented sub-bullet',
+  validateWeakenedProjectRuleFinding(prFinding('weakens-project-rule', 'NEVER force-push'), '- NEVER force-push', '- NEVER force-push\n  - except on your own branch').ok, true)
+check('accepts a parent bullet narrowed above an unchanged sub-bullet',
+  validateWeakenedProjectRuleFinding(prFinding('weakens-project-rule', 'NEVER call eval'), '- In src:\n  - NEVER call eval', '- In src/legacy only:\n  - NEVER call eval').ok, true)
+check('accepts a quote spanning two base bullets when the second gains an exception',
+  validateWeakenedProjectRuleFinding(prFinding('weakens-project-rule', 'NEVER force-push\n- NEVER delete main'), '- NEVER force-push\n- NEVER delete main', '- NEVER force-push\n- NEVER delete main unless asked').ok, true)
+check('rejects an unchanged rule with an unchanged nested sub-bullet',
+  validateWeakenedProjectRuleFinding(prFinding('weakens-project-rule', 'NEVER force-push'), '- NEVER force-push\n  - on shared branches', '- NEVER force-push\n  - on shared branches').reason, 'rule still present in projectRules')
+check('accepts an exception sub-bullet added after a blank line in a loose list',
+  validateWeakenedProjectRuleFinding(prFinding('weakens-project-rule', 'NEVER force-push'), '- NEVER force-push', '- NEVER force-push\n\n  - except on your own branch').ok, true)
+check('accepts an indented exception paragraph added after a blank line',
+  validateWeakenedProjectRuleFinding(prFinding('weakens-project-rule', 'NEVER force-push'), '- NEVER force-push', '- NEVER force-push\n\n  Except on your own branch.').ok, true)
+const introBase = 'These apply everywhere.\n- In domain code:\n  - NEVER mutate state'
+check('accepts a narrowed parent bullet under an intro paragraph',
+  validateWeakenedProjectRuleFinding(prFinding('weakens-project-rule', 'NEVER mutate state'), introBase, 'These apply everywhere.\n- In domain code, except scripts:\n  - NEVER mutate state').ok, true)
+check('accepts an exception sibling added under a parent bullet below an intro paragraph',
+  validateWeakenedProjectRuleFinding(prFinding('weakens-project-rule', 'NEVER mutate state'), introBase, introBase + '\n  - Mutation is fine in reducers').ok, true)
+check('rejects an unchanged loose-list rule with an unchanged indented paragraph',
+  validateWeakenedProjectRuleFinding(prFinding('weakens-project-rule', 'NEVER force-push'), '- NEVER force-push\n\n  on shared branches', '- NEVER force-push\n\n  on shared branches').reason, 'rule still present in projectRules')
+check('rejects unchanged blank-separated sibling bullets when another bullet is edited',
+  validateWeakenedProjectRuleFinding(prFinding('weakens-project-rule', 'NEVER force-push'), '- NEVER force-push\n\n- NEVER call eval', '- NEVER force-push\n\n- NEVER call eval in src').reason, 'rule still present in projectRules')
+check('rejects an unchanged bullet under a lead-in when a sibling is edited',
+  validateWeakenedProjectRuleFinding(prFinding('weakens-project-rule', 'NEVER force-push'), 'Rules:\n- NEVER force-push\n- NEVER call eval', 'Rules:\n- NEVER force-push\n- NEVER call eval, except tests').reason, 'rule still present in projectRules')
 check('rejects a weakened rule with no quote',
   validateWeakenedProjectRuleFinding({ rule: 'weakens-project-rule' }, planted).ok, false)
 const verifierInstructions = rdPr(join(SKILL, 'references', 'agents', 'verifier.md'), 'utf8')
@@ -772,6 +833,25 @@ const quoteA = { file: 'src/total.js', line: 2, title: 'Missing null check on to
 const quoteB = { ...quoteA, ruleQuote: 'ALWAYS validate total before use.' }
 check('two different quotes of one PROJECT rule are not sameIssue', sameIssue(quoteA, quoteB), false)
 check('the same quote of one PROJECT rule is still sameIssue', sameIssue(quoteA, { ...quoteA }), true)
+check('the same slug with quotes equal after normalisation is sameIssue',
+  sameIssue(quoteA, { ...quoteA, ruleQuote: '  never   SKIP the null check on total.  ' }), true)
+const slugB = { ...quoteA, rule: 'PROJECT:null-total-guard', ruleQuote: '**Never skip** the null check on total.' }
+check('two PROJECT slugs with one quote modulo case, whitespace and emphasis are sameIssue', sameIssue(quoteA, slugB), true)
+const [mergedSlugs] = dedup([{ ...quoteA, severity: 'important' }, { ...slugB, severity: 'important' }])
+check('different-slug same-quote findings merge into one finding that keeps rule and quote',
+  [dedup([{ ...quoteA, severity: 'important' }, { ...slugB, severity: 'important' }]).length, mergedSlugs.rule, typeof mergedSlugs.ruleQuote],
+  [1, 'PROJECT:no-null-total', 'string'])
+check('different-slug different-quote findings stay separate',
+  sameIssue(quoteA, { ...slugB, ruleQuote: 'ALWAYS validate total before use.' }), false)
+const quoteSamples = ['NEVER call `console.log` in src/.', '> **Never** skip\n  the   check', '- Use _early_ returns', '## Heading rule text']
+check('workflow normalizeRuleQuote agrees with the validator normalizeQuote',
+  quoteSamples.map(q => normalizeRuleQuote(q)), quoteSamples.map(q => normalizeQuote(q)))
+check('quotes differing only by trailing punctuation are not sameIssue',
+  sameIssue(quoteA, { ...quoteA, ruleQuote: 'NEVER skip the null check on total' }), false)
+console.log('\nworkflow: a confirmed weakened-rule finding is always Important')
+check('critical from the lens becomes important for weakens-project-rule',
+  weakenedRuleSeverity({ rule: 'weakens-project-rule' }, 'critical'), 'important')
+check('other rules keep the severity', weakenedRuleSeverity({ rule: 'TS-1' }, 'critical'), 'critical')
 
 // Prompt guard: every lens that reads projectRules is told to raise the tag.
 const lensFiles = ['quality', 'implementation', 'simplification', 'conventions', 'test-quality']
@@ -787,9 +867,11 @@ function liftBlock(name) {
   if (!m) throw new Error(`selftest: const ${name} not found in workflow.js`)
   return m[0]
 }
+// An older workflow.js lacks these constants; fall back so the checks FAIL instead of the suite crashing.
+const liftBlockOr = name => { try { return liftBlock(name) } catch { return `const ${name} = ''\n` } }
 const buildPrompt = new Function(
   'dim', 'SUPPRESSED', 'prevSha',
-  [liftBlock('PROJECT_RULE_DIMENSIONS'), liftBlock('PROJECT_RULE_INSTRUCTION'), liftConst('BUG_CLASS_INSTRUCTION'),
+  [liftBlockOr('PROJECT_RULE_DIMENSIONS'), liftBlockOr('PROJECT_RULE_INSTRUCTION'), liftConst('BUG_CLASS_INSTRUCTION'),
     `const targetMetadata = '{}', promptDir = 'p', repoSlug = 'o/r', prNumber = 1, prUrl = 'u',
        diffFile = 'd', contextFile = 'c', wtDisplay = 'w'`,
     lift('reviewPrompt'), 'return reviewPrompt(dim)'].join('\n'),
@@ -846,6 +928,12 @@ check('validator accepts a weakened-rule quote found in baseProjectRules',
 check('validator rejects a weakened-rule quote found only in projectRules',
   runV(weakenedFile, addedCtx), 1)
 wfPr(join(crashDir, 'rej.json'), JSON.stringify({ rule: 'PROJECT:no-eval', ruleQuote: 'NEVER call eval anywhere in code' }))
+const noBaseCtx = join(crashDir, 'nobase.json')
+wfPr(noBaseCtx, JSON.stringify({ projectRules: 'nothing here' }))
+check('exit 2 on a weakened finding when baseProjectRules is missing', runV(weakenedFile, noBaseCtx), 2)
+const stillCtx = join(crashDir, 'still.json')
+wfPr(stillCtx, JSON.stringify({ projectRules: 'NEVER call console.log in src/.', baseProjectRules: 'NEVER call console.log in src/.' }))
+check('exit 1 on a weakened finding whose rule is still in projectRules', runV(weakenedFile, stillCtx), 1)
 check('exit 1 on a rejected finding', runV(join(crashDir, 'rej.json'), okCtx), 1)
 const symlinkValidator = join(crashDir, 'project-rule-findings.mjs')
 syPr(join(SKILL, 'scripts', 'project-rule-findings.mjs'), symlinkValidator)

package/plugins/olko-github-pr/skills/lekker-review/scripts/setup-worktree.sh

@@ -157,24 +157,33 @@ if [[ "${LEKKER_RULES_ONLY:-}" == "1" ]]; then
         if git -C "$REPO_ROOT" fetch origin "+refs/heads/${PR_BRANCH}:refs/remotes/origin/${PR_BRANCH}" 2>/dev/null; then
             RULES_REF="origin/$PR_BRANCH"
         elif git -C "$REPO_ROOT" fetch origin "$PR_BRANCH" 2>/dev/null; then
-            RULES_REF=FETCH_HEAD
+            # The base fetch below overwrites FETCH_HEAD, so pin the PR tip now.
+            RULES_REF="$(git -C "$REPO_ROOT" rev-parse FETCH_HEAD)"
         else
             printf 'ERROR: could not fetch PR branch %s for rules-only scan\n' "$PR_BRANCH" >&2
             exit 1
         fi
     fi
+    # Base rules are best effort: a failure here keeps projectRules and nulls baseProjectRules,
+    # because the base copy only hardens validation and must not abort the scan.
+    RULES_BASE_SHA=""
     if [[ -n "${LEKKER_BASE_REF:-}" ]]; then
+        BASE_FETCH_OK=1
         if [[ -z "$LOCAL_REPO" && "$LEKKER_BASE_REF" == origin/* ]]; then
             BASE_BRANCH="${LEKKER_BASE_REF#origin/}"
-            if ! git -C "$REPO_ROOT" fetch origin \
-                "+refs/heads/${BASE_BRANCH}:refs/remotes/origin/${BASE_BRANCH}" 2>/dev/null; then
-                printf 'ERROR: could not fetch base ref %s for rules-only scan\n' "$LEKKER_BASE_REF" >&2
-                exit 1
-            fi
+            git -C "$REPO_ROOT" fetch origin \
+                "+refs/heads/${BASE_BRANCH}:refs/remotes/origin/${BASE_BRANCH}" 2>/dev/null || BASE_FETCH_OK=0
         fi
-        if ! git -C "$REPO_ROOT" rev-parse --verify -q "${LEKKER_BASE_REF}^{commit}" >/dev/null; then
-            printf 'ERROR: base ref %s does not resolve for rules-only scan\n' "$LEKKER_BASE_REF" >&2
-            exit 1
+        # Fork point, as in full mode: the base tip may carry rules added after the PR branched.
+        if [[ "$BASE_FETCH_OK" == "1" ]] \
+            && git -C "$REPO_ROOT" rev-parse --verify -q "${LEKKER_BASE_REF}^{commit}" >/dev/null; then
+            RULES_BASE_SHA="$(git -C "$REPO_ROOT" merge-base "$LEKKER_BASE_REF" "$RULES_REF" 2>/dev/null || true)"
+            # A fork older than the shallow clone depth has no common ancestor until history is deepened.
+            if [[ -z "$RULES_BASE_SHA" ]] \
+                && [[ "$(git -C "$REPO_ROOT" rev-parse --is-shallow-repository 2>/dev/null)" == "true" ]]; then
+                git -C "$REPO_ROOT" fetch -q --deepen=200 origin 2>/dev/null || true
+                RULES_BASE_SHA="$(git -C "$REPO_ROOT" merge-base "$LEKKER_BASE_REF" "$RULES_REF" 2>/dev/null || true)"
+            fi
         fi
     fi
     RULES_SOURCE="/tmp/lekker-rules-source-$$"
@@ -184,17 +193,19 @@ if [[ "${LEKKER_RULES_ONLY:-}" == "1" ]]; then
     BASE_PROJECT_RULES=""
     HAVE_BASE_RULES=0
     if [[ -n "${LEKKER_BASE_REF:-}" ]]; then
-        if BASE_PROJECT_RULES="$(collect_project_rules_at_ref "$REPO_ROOT" "$LEKKER_BASE_REF")"; then
+        if [[ -n "$RULES_BASE_SHA" ]] \
+            && BASE_PROJECT_RULES="$(collect_project_rules_at_ref "$REPO_ROOT" "$RULES_BASE_SHA")"; then
             HAVE_BASE_RULES=1
         else
             BASE_PROJECT_RULES=""
             NOTES="${NOTES}base-rules-unavailable;"
         fi
     fi
-    python3 - "$OUT_JSON" "$PROJECT_RULES" "$BASE_PROJECT_RULES" "$HAVE_BASE_RULES" <<'PYEOF'
+    python3 - "$OUT_JSON" "$PROJECT_RULES" "$BASE_PROJECT_RULES" "$HAVE_BASE_RULES" "$NOTES" <<'PYEOF'
 import json, sys
 out = {"projectRules": sys.argv[2]}
 out["baseProjectRules"] = sys.argv[3] if sys.argv[4] == "1" else None
+out["notes"] = sys.argv[5]
 with open(sys.argv[1], "w") as f:
     json.dump(out, f, indent=2)
 PYEOF

package/plugins/olko-github-pr/skills/lekker-review/scripts/validate-lines.mjs

@@ -75,6 +75,8 @@ export function loadDedup(workflowPath = join(SKILL, 'workflow.js')) {
     liftConst('HARD_RULES', 'const HARD_RULES = new Set()'),
     liftConst('SAME_ISSUE_LINE_WINDOW', 'const SAME_ISSUE_LINE_WINDOW = 30'),
     liftConst('SEVERITY_RANK', 'const SEVERITY_RANK = { critical: 3, important: 2, observation: 1, idiomatic: 0 }'),
+    // Absent from an older workflow.js, whose sameIssue does not call it.
+    (() => { try { return lift('normalizeRuleQuote') } catch { return '' } })(),
     ...['titleTokens', 'sameIssue', 'nearbyLines', 'spanWithinWindow',
         'isHardRule', 'longest', 'mergeFindings', 'dedup'].map(lift),
   ].join('\n')

package/plugins/olko-github-pr/skills/lekker-review/workflow.js

@@ -166,12 +166,31 @@ function titleTokens(title) {
   return words.filter(function(w) { return w.length > 2 })
 }
 
+// Same normalisation as normalizeQuote in scripts/project-rule-findings.mjs; workflow.js cannot import it.
+// The selftest asserts the two agree.
+function normalizeRuleQuote(text) {
+  return String(text == null ? '' : text)
+    .replace(/(^|\n)\s{0,3}#{1,6}\s+/g, '$1')
+    .replace(/(^|\n)\s{0,3}>\s?/g, '$1')
+    .replace(/`([^`\n]+)`/g, '$1')
+    .replace(/(^|[\s([{])(\*{1,2}|_{1,2})(\S(?:.*?\S)?)\2(?=$|[\s.,;:!?)}\]])/g, '$1$3')
+    .replace(/^\s*[-+]\s+/gm, ' ')
+    .replace(/\s+/g, ' ')
+    .trim()
+    .toLowerCase()
+}
+
+function weakenedRuleSeverity(finding, severity) {
+  return finding.rule === 'weakens-project-rule' ? 'important' : severity
+}
+
 function sameIssue(a, b) {
+  const qa = normalizeRuleQuote(a.ruleQuote)
+  const qb = normalizeRuleQuote(b.ruleQuote)
   // Lens-generated slugs can differ even when they identify the same project rule.
   const sameProjectQuote = typeof a.rule === 'string' && a.rule.startsWith('PROJECT:')
     && typeof b.rule === 'string' && b.rule.startsWith('PROJECT:')
-    && typeof a.ruleQuote === 'string' && a.ruleQuote.trim() !== ''
-    && a.ruleQuote === b.ruleQuote
+    && qa !== '' && qa === qb
   if (typeof a.rule === 'string' && typeof b.rule === 'string' && a.rule !== b.rule
       && (a.rule.startsWith('PROJECT:') || b.rule.startsWith('PROJECT:'))
       && !sameProjectQuote) {
@@ -179,9 +198,7 @@ function sameIssue(a, b) {
   }
   // Two quotes of one PROJECT rule that differ are two different rule passages, not one issue.
   if (typeof a.rule === 'string' && a.rule === b.rule && a.rule.startsWith('PROJECT:')
-      && typeof a.ruleQuote === 'string' && a.ruleQuote.trim() !== ''
-      && typeof b.ruleQuote === 'string' && b.ruleQuote.trim() !== ''
-      && a.ruleQuote !== b.ruleQuote) {
+      && qa !== '' && qb !== '' && qa !== qb) {
     return false
   }
   // Merging two classes would send one class's instances to the other's fix.
@@ -701,7 +718,7 @@ const budgetAtStart = budget.spent()
       `FINDING (JSON): ${JSON.stringify(finding)}.`,
       `DIFF_FILE=${diffFile}, CONTEXT_FILE=${contextFile}, WORKTREE_PATH=${wtDisplay}.`,
       `HOUSE_RULES_FILE: read key "houseRulesFile" from CONTEXT_FILE, then read that exact path before validating a hard rule.`,
-      `Default to dropping when uncertain, except when the PROJECT-rule validator was unavailable: then check by hand that the exact quote appears in baseProjectRules when it is a string, otherwise projectRules (drop if it does not), keep the finding only if it does, set validatorUnavailable true, and judge applicability.`,
+      `Default to dropping when uncertain, except when the PROJECT-rule validator was unavailable: then check by hand that the exact quote appears in baseProjectRules when it is a string, otherwise projectRules (drop if it does not), keep the finding only if it does, set validatorUnavailable true, and judge applicability. For rule "weakens-project-rule" check baseProjectRules ONLY: drop it when baseProjectRules is not a string or the quote is absent there, and never consult projectRules.`,
     ].join(' ')
   }
 
@@ -839,6 +856,7 @@ const budgetAtStart = budget.spent()
 
         // confirmed
         const confirmed = Object.assign({}, finding)
+        confirmed.severity = weakenedRuleSeverity(finding, confirmed.severity)
         confirmed.verificationStatus = isHardRule(finding) ? 'hard-rule-confirmed' : 'confirmed'
         confirmed.verifierReasoning = verdict.reasoning
         return confirmed

package/plugins/olko-obsidian/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-obsidian",
   "description": "Keep an Obsidian vault in sync with work: PR sync, task rollover, morning routine.",
-  "version": "1.71.0",
+  "version": "1.71.1",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-product/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-product",
   "description": "Take a product idea to a shippable build: MVP passes, full-stack scaffolds, UX/UI quality loops, launch plans.",
-  "version": "1.71.0",
+  "version": "1.71.1",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-reflection/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-reflection",
   "description": "Look back and improve: self-critique, retrospectives, performance review, rapid learning.",
-  "version": "1.71.0",
+  "version": "1.71.1",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-release/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-release",
   "description": "Ship a release: semantic-release setup, changelogs, store listing copy, release-day routine.",
-  "version": "1.71.0",
+  "version": "1.71.1",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-skill-meta/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-skill-meta",
   "description": "Author and maintain agent skills and the AI toolchain itself.",
-  "version": "1.71.0",
+  "version": "1.71.1",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-web-ops/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-web-ops",
   "description": "Operate a website: WAF rules, search console audits, analytics bootstrap, docs indexes.",
-  "version": "1.71.0",
+  "version": "1.71.1",
   "author": {
     "name": "Oleg Koval"
   },