@olegkoval/agent-skills 1.72.0 → 1.74.0

package/adapters/claude/olko-github-pr/skills/lekker-review/SKILL.md

@@ -434,7 +434,7 @@ skip the review because the log failed, just say `run log unavailable`.
 | Context: issue-tracker/CI/diff/existing-reviews | always | always | always | always |
 | Context: chat/docs/framework-docs/monitoring/prior-review-memory (optional, MCP-dependent) | skip | skip | included | included + broader recall |
 | Worktree + static checks    | included (`npm ci` per changed lockfile) | skip (WORKTREE_PATH=null) unless `--fix` | included | included          |
-| Review agents               | 1 deps checklist      | 2 triage (haiku)      | 5 specialists (sonnet) | 5 specialists (sonnet)  |
+| Review agents               | 1 deps checklist      | 2 triage (haiku) + project-rules (sonnet) | 5 specialists + project-rules (sonnet) | 5 specialists + project-rules (sonnet)  |
 | Per-finding verification    | none                  | Criticals + Importants | Criticals + Importants | Criticals + Importants |
 | Completeness critic         | skip                  | skip                  | skip                | included                   |
 | Proof-of-bug (failing test per Critical or composed-boundary Important) | skip | skip | included (max 5)    | included (max 5)           |
@@ -767,8 +767,8 @@ must pass it, or the workflow throws on its missing-args guard.
 
 Two optional args tune concurrency; omit both unless a run needs it:
 
-- `reviewBatchPlan` - batch sizes for the review dimensions, default `[5]`
-  (all five at once). The last entry repeats to cover any remainder, so
+- `reviewBatchPlan` - batch sizes for the review dimensions, default `[6]`
+  (all six at once). The last entry repeats to cover any remainder, so
   `[2]` would mean two at a time.
 - `maxConcurrent` - cap for the per-finding fan-outs (verify, critic, prove),
   default `5`.
@@ -780,8 +780,9 @@ The workflow runs three phases:
 
 - **Review:** deps uses the single `deps` checklist agent; scan uses `[triage-quality, triage-logic]` on `haiku`; medium/deep
   use 5 specialists (quality, implementation, simplification, conventions,
-  test-quality) on `sonnet`. Agents receive DIFF_FILE + CONTEXT_FILE by path.
-  All five run concurrently: the stage is self-limiting at one agent per
+  test-quality) on `sonnet`. Scan, medium and deep also run `project-rules`
+  (sonnet), which only checks the diff against each project rule. Agents receive DIFF_FILE + CONTEXT_FILE by path.
+  All run concurrently: the stage is self-limiting at one agent per
   dimension. All reviewers run to completion before verification starts.
   Override per run with the `reviewBatchPlan` arg (e.g. `[1]` runs them
   strictly one at a time on a constrained machine).
@@ -1429,7 +1430,9 @@ threads remain in the total but do not count as dismissed. Only comments ending
 counted, so PRs posted before the marker existed score zero comments.
 **Eval harness.** `evals/manifest.json` lists PRs with a known outcome (`expect:
 "buggy"` with `knownBug: "file:line description"`, or `"clean"`). Run lekker on
-each, save the `findings` arrays as `{"<repo>#<pr>": [...]}`, then
+each, save the `findings` arrays under each case's key (`id`, else
+`<repo>#<pr>@<sha>` when the entry has `sha`, else `<repo>#<pr>`), for example
+`{"<repo>#<pr>": [...]}`; a value may be an array of runs to get a hit rate, then
 `node "${SKILL_ROOT}/scripts/eval-runner.mjs" --manifest "${SKILL_ROOT}/evals/manifest.json" --results <results.json>`
 prints recall on buggy PRs and the false-positive count (critical or important
 findings) on clean ones. The shipped manifest holds two placeholders; choosing

package/adapters/claude/olko-github-pr/skills/lekker-review/evals/manifest.json

@@ -1,5 +1,5 @@
 {
-  "note": "PLACEHOLDERS ONLY. Replace with real PRs chosen by a human: known-buggy PRs with the bug located, and clean PRs that merged without follow-up fixes.",
+  "note": "PLACEHOLDERS ONLY. Replace with real PRs chosen by a human: known-buggy PRs with the bug located, and clean PRs that merged without follow-up fixes. Add id or sha to an entry to list the same PR at two commits (buggy head, merged head); a results value may be an array of runs.",
   "prs": [
     {
       "repo": "example-org/example-repo",

package/adapters/claude/olko-github-pr/skills/lekker-review/references/agents/project-rules.md

@@ -0,0 +1,48 @@
+# project-rules: lekker-review agent prompt
+You will receive in your task message: REPO_SLUG, PR_NUMBER, PR_URL, DIFF_FILE, CONTEXT_FILE (JSON), WORKTREE_PATH (may be null).
+Your findings are returned via the StructuredOutput schema enforced by the caller.
+
+You are the project-rules reviewer. Your only job is to find changed lines that
+break the repository's own written rules. Report nothing else: no general bugs,
+no style, no suggestions. Other agents cover those.
+
+Procedure:
+1. Read CONTEXT_FILE. The authoritative rules are "baseProjectRules" when it is a
+   string (the base branch's copy, which the PR author cannot edit), otherwise
+   "projectRules". When the chosen source is missing or empty, return
+   `{"findings": []}` and stop.
+2. List every rule written as a prohibition or an obligation (NEVER, MUST,
+   MUST NOT, ALWAYS, DO NOT, or a plain-English equivalent). Work through the
+   whole source: a rule buried in a long file counts exactly as much as the
+   first one. Preferences and suggestions are not rules.
+3. Read DIFF_FILE. For EACH listed rule, check every `+` line against it. Do not
+   rely on skimming: go rule by rule.
+4. When a rule has a mechanical signature (a literal string, API or function
+   name, import, file pattern, naming pattern, template-literal shape), derive
+   the pattern and search the diff for it (grep or Bash is allowed) instead of
+   relying on reading. Check added file paths in the diff headers too.
+5. A rule is broken by a `+` line (or an added file). Unchanged code is out of
+   scope.
+6. Separately, when "baseProjectRules" is a string, check every `-` line in
+   DIFF_FILE against its rule lines (including the rules files themselves, such
+   as CLAUDE.md or AGENTS.md). A rule line that is removed, or reworded so it
+   forbids or requires less (a NEVER softened to a preference, a dropped
+   exception list, a narrowed scope), is a breach even when no `+` line violates
+   anything. The PR's own copy cannot clear it: compare against the base copy.
+
+Reporting contract (same as the PROJECT RULES AS HARD RULES instruction below):
+- One finding per broken rule, Critical, `rule` set to `PROJECT:<short-kebab-slug>`,
+  `ruleQuote` set to the exact sentence from the authoritative source, file:line on
+  the first violating line, every other violating site in `otherInstances`.
+- When the diff deletes or weakens a rule line that is in "baseProjectRules"
+  (procedure step 6), report an Important finding with `rule`
+  "weakens-project-rule", `ruleQuote` set to the exact base-branch sentence,
+  file:line on the removed or reworded line, and `badCode` set to the verbatim
+  `-` line (plus the replacing `+` line when there is one). `fix` is to restore
+  the rule or to state why the project dropped it.
+- Never quote a rule that is not in the authoritative source.
+- `badCode` is REQUIRED: the verbatim violating line copied from the diff. `fix`
+  is REQUIRED: a concrete drop-in replacement that follows the rule. If you cannot
+  quote and fix it, drop it.
+
+CI status, acceptance criteria and existing reviews are not your concern.

package/adapters/claude/olko-github-pr/skills/lekker-review/references/codex-workflow.md

@@ -66,9 +66,9 @@ unavailable; do not infer what it meant from prose.
 Select dimensions exactly as the Claude workflow does:
 
 - deps: `deps` (single checklist agent; no verifier, no prover)
-- scan: `triage-quality`, `triage-logic`
+- scan: `triage-quality`, `triage-logic`, `project-rules`
 - medium/deep: `quality`, `implementation`, `simplification`, `conventions`,
-  `test-quality`
+  `test-quality`, `project-rules`
 
 For each dimension, spawn a `default` read-only agent with the following
 bounded task:

package/adapters/claude/olko-github-pr/skills/lekker-review/scripts/eval-runner.mjs

@@ -4,15 +4,20 @@
 // Usage:
 //   node eval-runner.mjs --manifest evals/manifest.json --results <results.json> [--json]
 //
-// manifest.json: { prs: [{ repo, pr, expect: "buggy"|"clean", knownBug?: "file:line + description" }] }
-// results.json:  { "<repo>#<pr>": [ <finding>, ... ] }  the findings of one lekker run per PR
-//                (the `findings` array the workflow returns). A PR missing from results is
+// manifest.json: { prs: [{ repo, pr, expect: "buggy"|"clean", knownBug?: "file:line + description", id?, sha? }] }
+//                The case key is `id` when present, else "<repo>#<pr>@<sha>" when `sha` is
+//                present, else "<repo>#<pr>". Use id or sha to list one PR at two commits.
+// results.json:  { "<case key>": [ <finding>, ... ] }  the findings of one lekker run per case
+//                (the `findings` array the workflow returns), or an array of such arrays for
+//                repeated runs, which adds per-case hitRate and per-run counts to separate
+//                model noise from a real difference. A case missing from results is
 //                reported as unscored, never as zero findings.
 //
 // A buggy PR is HIT when some finding is on the knownBug file within LINE_WINDOW lines
 // of the knownBug line. Known limitation: the match is by location only, so a
 // same-file finding near the line counts even if it describes a different problem;
-// judging "same bug" needs an LLM or a description match and is not attempted. Recall = hits / scored buggy PRs. On a clean PR every
+// judging "same bug" needs an LLM or a description match and is not attempted. Recall = hits /
+// scored buggy runs (one run per case unless a case has repeated runs). On a clean PR every
 // verdict-affecting finding (critical or important) is a false positive.
 
 import { readFileSync } from 'node:fs';
@@ -38,6 +43,15 @@ export function isHit(findings, knownBug) {
     && Math.abs(f.line - spot.line) <= LINE_WINDOW);
 }
 
+export function caseKey(e) {
+  if (typeof e.id === 'string' && e.id) return e.id;
+  return typeof e.sha === 'string' && e.sha ? `${e.repo}#${e.pr}@${e.sha}` : `${e.repo}#${e.pr}`;
+}
+
+const SHA = /^[0-9a-f]{7,40}$/i;
+
+const isMultiRun = (v) => Array.isArray(v) && v.length > 0 && v.every(Array.isArray);
+
 export function validateManifest(manifest) {
   const prs = manifest && Array.isArray(manifest.prs) ? manifest.prs : null;
   if (!prs) throw new Error('manifest needs a "prs" array');
@@ -45,7 +59,9 @@ export function validateManifest(manifest) {
   prs.forEach((e, i) => {
     if (!e.repo || !Number.isInteger(e.pr)) throw new Error(`prs[${i}]: repo and integer pr are required`);
     if (e.expect !== 'buggy' && e.expect !== 'clean') throw new Error(`prs[${i}]: expect must be "buggy" or "clean"`);
-    const key = `${e.repo}#${e.pr}`;
+    if ('id' in e && (typeof e.id !== 'string' || !e.id)) throw new Error(`prs[${i}]: id must be a non-empty string`);
+    if ('sha' in e && (typeof e.sha !== 'string' || !SHA.test(e.sha))) throw new Error(`prs[${i}]: sha must be 7 to 40 hex characters`);
+    const key = caseKey(e);
     if (seen.has(key)) throw new Error(`prs[${i}]: duplicate entry ${key}`);
     seen.add(key);
     if (e.expect === 'buggy' && !parseKnownBug(e.knownBug)) {
@@ -57,25 +73,42 @@ export function validateManifest(manifest) {
 
 export function score(manifest, results) {
   const rows = validateManifest(manifest).map((e) => {
-    const key = `${e.repo}#${e.pr}`;
-    const findings = results[key];
-    if (!Array.isArray(findings)) return { key, expect: e.expect, scored: false };
-    if (e.expect === 'buggy') return { key, expect: 'buggy', scored: true, hit: isHit(findings, e.knownBug) };
+    const key = caseKey(e);
+    const value = results[key];
+    if (!Array.isArray(value)) return { key, expect: e.expect, scored: false };
+    const runs = isMultiRun(value) ? value : null;
+    if (e.expect === 'buggy') {
+      if (!runs) return { key, expect: 'buggy', scored: true, hit: isHit(value, e.knownBug) };
+      const hits = runs.filter((r) => isHit(r, e.knownBug)).length;
+      return { key, expect: 'buggy', scored: true, hit: hits > 0, runs: runs.length, hits, hitRate: hits / runs.length };
+    }
+    const fp = (r) => r.filter((f) => BLOCKING.has(f.severity)).length;
+    if (!runs) return { key, expect: 'clean', scored: true, falsePositives: fp(value) };
+    const perRun = runs.map(fp);
     return {
-      key, expect: 'clean', scored: true,
-      falsePositives: findings.filter((f) => BLOCKING.has(f.severity)).length,
+      key, expect: 'clean', scored: true, falsePositives: perRun.reduce((n, x) => n + x, 0),
+      runs: runs.length, falsePositivesPerRun: perRun,
     };
   });
   const buggy = rows.filter((r) => r.expect === 'buggy' && r.scored);
   const clean = rows.filter((r) => r.expect === 'clean' && r.scored);
-  return {
-    recall: buggy.length === 0 ? null : buggy.filter((r) => r.hit).length / buggy.length,
+  const buggyRuns = buggy.reduce((n, r) => n + (r.runs || 1), 0);
+  const cleanRuns = clean.reduce((n, r) => n + (r.runs || 1), 0);
+  const falsePositives = clean.reduce((n, r) => n + r.falsePositives, 0);
+  const out = {
+    recall: buggyRuns === 0 ? null : buggy.reduce((n, r) => n + (r.runs ? r.hits : Number(r.hit)), 0) / buggyRuns,
     buggyScored: buggy.length,
-    falsePositives: clean.reduce((n, r) => n + r.falsePositives, 0),
+    falsePositives,
     cleanScored: clean.length,
     unscored: rows.filter((r) => !r.scored).map((r) => r.key),
     rows,
   };
+  if (rows.some((r) => r.runs)) {
+    Object.assign(out, {
+      buggyRuns, cleanRuns, falsePositivesPerCleanRun: cleanRuns === 0 ? null : falsePositives / cleanRuns,
+    });
+  }
+  return out;
 }
 
 function main(argv) {
@@ -86,8 +119,13 @@ function main(argv) {
   }
   const out = score(JSON.parse(readFileSync(flag('manifest'), 'utf8')), JSON.parse(readFileSync(flag('results'), 'utf8')));
   if (argv.includes('--json')) { console.log(JSON.stringify(out)); return; }
-  const pct = out.recall === null ? 'n/a' : `${Math.round(out.recall * 100)}%`;
-  console.log(`recall ${pct} (${out.buggyScored} buggy scored), false positives ${out.falsePositives} (${out.cleanScored} clean scored), unscored ${out.unscored.length}`);
+  const pct = (x) => (x === null ? 'n/a' : `${Math.round(x * 100)}%`);
+  if (out.buggyRuns === undefined) {
+    console.log(`recall ${pct(out.recall)} (${out.buggyScored} buggy scored), false positives ${out.falsePositives} (${out.cleanScored} clean scored), unscored ${out.unscored.length}`);
+    return;
+  }
+  const perRun = out.falsePositivesPerCleanRun === null ? 'n/a' : out.falsePositivesPerCleanRun.toFixed(2);
+  console.log(`recall ${pct(out.recall)} per run (${out.buggyRuns} runs over ${out.buggyScored} buggy cases), false positives ${out.falsePositives} (${out.cleanRuns} runs over ${out.cleanScored} clean cases, ${perRun} per run), unscored ${out.unscored.length}`);
 }
 
 if (process.argv[1] === fileURLToPath(import.meta.url)) main(process.argv.slice(2));

package/adapters/claude/olko-github-pr/skills/lekker-review/scripts/selftest.mjs

@@ -335,8 +335,8 @@ console.log('\ndeps depth: routing, classifier, line validation')
     const dimensionsFor = new Function(dimsSrc + '\nreturn dimensionsFor')()
     const M = { review: 'r', triage: 't' }
     check('deps runs exactly one agent', dimensionsFor('deps', M).map(d => d.file), ['deps.md'])
-    check('scan still runs the triage pair', dimensionsFor('scan', M).length, 2)
-    check('medium still runs five specialists', dimensionsFor('medium', M).length, 5)
+    check('scan runs the triage pair plus project-rules', dimensionsFor('scan', M).map(d => d.key), ['triage-quality', 'triage-logic', 'project-rules'])
+    check('medium runs five specialists plus project-rules', dimensionsFor('medium', M).length, 6)
     check('every dimension prompt file exists',
       ['deps', 'scan', 'medium'].flatMap(d => dimensionsFor(d, M)).every(d => existsSync(join(SKILL, 'references', 'agents', d.file))), true)
   }
@@ -871,7 +871,8 @@ function liftBlock(name) {
 const liftBlockOr = name => { try { return liftBlock(name) } catch { return `const ${name} = ''\n` } }
 const buildPrompt = new Function(
   'dim', 'SUPPRESSED', 'prevSha',
-  [liftBlockOr('PROJECT_RULE_DIMENSIONS'), liftBlockOr('PROJECT_RULE_INSTRUCTION'), liftConst('BUG_CLASS_INSTRUCTION'),
+  [liftBlockOr('PROJECT_RULE_DIMENSIONS'), liftBlockOr('PROJECT_RULE_CORE'), liftBlockOr('IGNORE_ENTRY_NOTE'),
+    liftBlockOr('PROJECT_RULE_INSTRUCTION'), liftBlockOr('PROJECT_RULE_ONLY_INSTRUCTION'), liftConst('BUG_CLASS_INSTRUCTION'),
     `const targetMetadata = '{}', promptDir = 'p', repoSlug = 'o/r', prNumber = 1, prUrl = 'u',
        diffFile = 'd', contextFile = 'c', wtDisplay = 'w'`,
     lift('reviewPrompt'), 'return reviewPrompt(dim)'].join('\n'),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@olegkoval/agent-skills",
-  "version": "1.72.0",
+  "version": "1.74.0",
   "private": false,
   "publishConfig": {
     "access": "public"

package/plugins/olko-apple-kit/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-apple-kit",
   "description": "Build and ship Apple platform apps: macOS menubar apps, App Store submissions.",
-  "version": "1.72.0",
+  "version": "1.74.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-creative/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-creative",
   "description": "Creative and personal projects: photo galleries, music players, listings, wiki editing.",
-  "version": "1.72.0",
+  "version": "1.74.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-garmin-kit/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-garmin-kit",
   "description": "Build, test and publish Garmin Connect IQ watch faces.",
-  "version": "1.72.0",
+  "version": "1.74.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-git-tools/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-git-tools",
   "description": "Everyday git and GitHub CLI operations: conventional commits, branch hygiene.",
-  "version": "1.72.0",
+  "version": "1.74.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-github-pr/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-github-pr",
   "description": "Drive GitHub pull requests to merge-ready: review-bot loops, CI fixes, descriptions, dependency triage.",
-  "version": "1.72.0",
+  "version": "1.74.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-github-pr/skills/lekker-review/README.md

@@ -2,8 +2,8 @@
 
 FAANG-quality PR code review for GitHub. It gathers the context a human reviewer
 would gather and checks the branch out into an isolated worktree when the depth
-requires one. `scan` runs two triage agents. `medium` and
-`deep` run five specialists and attempt proofs for at most five non-rule
+requires one. `scan` runs two triage agents plus project-rules. `medium` and
+`deep` run five specialists plus project-rules and attempt proofs for at most five non-rule
 Critical findings.
 
 ![lekker-review at a glance](assets/poster-overview.png)

package/plugins/olko-github-pr/skills/lekker-review/SKILL.md

@@ -433,7 +433,7 @@ skip the review because the log failed, just say `run log unavailable`.
 | Context: issue-tracker/CI/diff/existing-reviews | always | always | always | always |
 | Context: chat/docs/framework-docs/monitoring/prior-review-memory (optional, MCP-dependent) | skip | skip | included | included + broader recall |
 | Worktree + static checks    | included (`npm ci` per changed lockfile) | skip (WORKTREE_PATH=null) unless `--fix` | included | included          |
-| Review agents               | 1 deps checklist      | 2 triage (haiku)      | 5 specialists (sonnet) | 5 specialists (sonnet)  |
+| Review agents               | 1 deps checklist      | 2 triage (haiku) + project-rules (sonnet) | 5 specialists + project-rules (sonnet) | 5 specialists + project-rules (sonnet)  |
 | Per-finding verification    | none                  | Criticals + Importants | Criticals + Importants | Criticals + Importants |
 | Completeness critic         | skip                  | skip                  | skip                | included                   |
 | Proof-of-bug (failing test per Critical or composed-boundary Important) | skip | skip | included (max 5)    | included (max 5)           |
@@ -766,8 +766,8 @@ must pass it, or the workflow throws on its missing-args guard.
 
 Two optional args tune concurrency; omit both unless a run needs it:
 
-- `reviewBatchPlan` - batch sizes for the review dimensions, default `[5]`
-  (all five at once). The last entry repeats to cover any remainder, so
+- `reviewBatchPlan` - batch sizes for the review dimensions, default `[6]`
+  (all six at once). The last entry repeats to cover any remainder, so
   `[2]` would mean two at a time.
 - `maxConcurrent` - cap for the per-finding fan-outs (verify, critic, prove),
   default `5`.
@@ -779,8 +779,9 @@ The workflow runs three phases:
 
 - **Review:** deps uses the single `deps` checklist agent; scan uses `[triage-quality, triage-logic]` on `haiku`; medium/deep
   use 5 specialists (quality, implementation, simplification, conventions,
-  test-quality) on `sonnet`. Agents receive DIFF_FILE + CONTEXT_FILE by path.
-  All five run concurrently: the stage is self-limiting at one agent per
+  test-quality) on `sonnet`. Scan, medium and deep also run `project-rules`
+  (sonnet), which only checks the diff against each project rule. Agents receive DIFF_FILE + CONTEXT_FILE by path.
+  All run concurrently: the stage is self-limiting at one agent per
   dimension. All reviewers run to completion before verification starts.
   Override per run with the `reviewBatchPlan` arg (e.g. `[1]` runs them
   strictly one at a time on a constrained machine).
@@ -1428,7 +1429,9 @@ threads remain in the total but do not count as dismissed. Only comments ending
 counted, so PRs posted before the marker existed score zero comments.
 **Eval harness.** `evals/manifest.json` lists PRs with a known outcome (`expect:
 "buggy"` with `knownBug: "file:line description"`, or `"clean"`). Run lekker on
-each, save the `findings` arrays as `{"<repo>#<pr>": [...]}`, then
+each, save the `findings` arrays under each case's key (`id`, else
+`<repo>#<pr>@<sha>` when the entry has `sha`, else `<repo>#<pr>`), for example
+`{"<repo>#<pr>": [...]}`; a value may be an array of runs to get a hit rate, then
 `node "${SKILL_ROOT}/scripts/eval-runner.mjs" --manifest "${SKILL_ROOT}/evals/manifest.json" --results <results.json>`
 prints recall on buggy PRs and the false-positive count (critical or important
 findings) on clean ones. The shipped manifest holds two placeholders; choosing

package/plugins/olko-github-pr/skills/lekker-review/evals/manifest.json

@@ -1,5 +1,5 @@
 {
-  "note": "PLACEHOLDERS ONLY. Replace with real PRs chosen by a human: known-buggy PRs with the bug located, and clean PRs that merged without follow-up fixes.",
+  "note": "PLACEHOLDERS ONLY. Replace with real PRs chosen by a human: known-buggy PRs with the bug located, and clean PRs that merged without follow-up fixes. Add id or sha to an entry to list the same PR at two commits (buggy head, merged head); a results value may be an array of runs.",
   "prs": [
     {
       "repo": "example-org/example-repo",

package/plugins/olko-github-pr/skills/lekker-review/references/agents/project-rules.md

@@ -0,0 +1,48 @@
+# project-rules: lekker-review agent prompt
+You will receive in your task message: REPO_SLUG, PR_NUMBER, PR_URL, DIFF_FILE, CONTEXT_FILE (JSON), WORKTREE_PATH (may be null).
+Your findings are returned via the StructuredOutput schema enforced by the caller.
+
+You are the project-rules reviewer. Your only job is to find changed lines that
+break the repository's own written rules. Report nothing else: no general bugs,
+no style, no suggestions. Other agents cover those.
+
+Procedure:
+1. Read CONTEXT_FILE. The authoritative rules are "baseProjectRules" when it is a
+   string (the base branch's copy, which the PR author cannot edit), otherwise
+   "projectRules". When the chosen source is missing or empty, return
+   `{"findings": []}` and stop.
+2. List every rule written as a prohibition or an obligation (NEVER, MUST,
+   MUST NOT, ALWAYS, DO NOT, or a plain-English equivalent). Work through the
+   whole source: a rule buried in a long file counts exactly as much as the
+   first one. Preferences and suggestions are not rules.
+3. Read DIFF_FILE. For EACH listed rule, check every `+` line against it. Do not
+   rely on skimming: go rule by rule.
+4. When a rule has a mechanical signature (a literal string, API or function
+   name, import, file pattern, naming pattern, template-literal shape), derive
+   the pattern and search the diff for it (grep or Bash is allowed) instead of
+   relying on reading. Check added file paths in the diff headers too.
+5. A rule is broken by a `+` line (or an added file). Unchanged code is out of
+   scope.
+6. Separately, when "baseProjectRules" is a string, check every `-` line in
+   DIFF_FILE against its rule lines (including the rules files themselves, such
+   as CLAUDE.md or AGENTS.md). A rule line that is removed, or reworded so it
+   forbids or requires less (a NEVER softened to a preference, a dropped
+   exception list, a narrowed scope), is a breach even when no `+` line violates
+   anything. The PR's own copy cannot clear it: compare against the base copy.
+
+Reporting contract (same as the PROJECT RULES AS HARD RULES instruction below):
+- One finding per broken rule, Critical, `rule` set to `PROJECT:<short-kebab-slug>`,
+  `ruleQuote` set to the exact sentence from the authoritative source, file:line on
+  the first violating line, every other violating site in `otherInstances`.
+- When the diff deletes or weakens a rule line that is in "baseProjectRules"
+  (procedure step 6), report an Important finding with `rule`
+  "weakens-project-rule", `ruleQuote` set to the exact base-branch sentence,
+  file:line on the removed or reworded line, and `badCode` set to the verbatim
+  `-` line (plus the replacing `+` line when there is one). `fix` is to restore
+  the rule or to state why the project dropped it.
+- Never quote a rule that is not in the authoritative source.
+- `badCode` is REQUIRED: the verbatim violating line copied from the diff. `fix`
+  is REQUIRED: a concrete drop-in replacement that follows the rule. If you cannot
+  quote and fix it, drop it.
+
+CI status, acceptance criteria and existing reviews are not your concern.

package/plugins/olko-github-pr/skills/lekker-review/references/codex-workflow.md

@@ -66,9 +66,9 @@ unavailable; do not infer what it meant from prose.
 Select dimensions exactly as the Claude workflow does:
 
 - deps: `deps` (single checklist agent; no verifier, no prover)
-- scan: `triage-quality`, `triage-logic`
+- scan: `triage-quality`, `triage-logic`, `project-rules`
 - medium/deep: `quality`, `implementation`, `simplification`, `conventions`,
-  `test-quality`
+  `test-quality`, `project-rules`
 
 For each dimension, spawn a `default` read-only agent with the following
 bounded task:

package/plugins/olko-github-pr/skills/lekker-review/scripts/eval-runner.mjs

@@ -4,15 +4,20 @@
 // Usage:
 //   node eval-runner.mjs --manifest evals/manifest.json --results <results.json> [--json]
 //
-// manifest.json: { prs: [{ repo, pr, expect: "buggy"|"clean", knownBug?: "file:line + description" }] }
-// results.json:  { "<repo>#<pr>": [ <finding>, ... ] }  the findings of one lekker run per PR
-//                (the `findings` array the workflow returns). A PR missing from results is
+// manifest.json: { prs: [{ repo, pr, expect: "buggy"|"clean", knownBug?: "file:line + description", id?, sha? }] }
+//                The case key is `id` when present, else "<repo>#<pr>@<sha>" when `sha` is
+//                present, else "<repo>#<pr>". Use id or sha to list one PR at two commits.
+// results.json:  { "<case key>": [ <finding>, ... ] }  the findings of one lekker run per case
+//                (the `findings` array the workflow returns), or an array of such arrays for
+//                repeated runs, which adds per-case hitRate and per-run counts to separate
+//                model noise from a real difference. A case missing from results is
 //                reported as unscored, never as zero findings.
 //
 // A buggy PR is HIT when some finding is on the knownBug file within LINE_WINDOW lines
 // of the knownBug line. Known limitation: the match is by location only, so a
 // same-file finding near the line counts even if it describes a different problem;
-// judging "same bug" needs an LLM or a description match and is not attempted. Recall = hits / scored buggy PRs. On a clean PR every
+// judging "same bug" needs an LLM or a description match and is not attempted. Recall = hits /
+// scored buggy runs (one run per case unless a case has repeated runs). On a clean PR every
 // verdict-affecting finding (critical or important) is a false positive.
 
 import { readFileSync } from 'node:fs';
@@ -38,6 +43,15 @@ export function isHit(findings, knownBug) {
     && Math.abs(f.line - spot.line) <= LINE_WINDOW);
 }
 
+export function caseKey(e) {
+  if (typeof e.id === 'string' && e.id) return e.id;
+  return typeof e.sha === 'string' && e.sha ? `${e.repo}#${e.pr}@${e.sha}` : `${e.repo}#${e.pr}`;
+}
+
+const SHA = /^[0-9a-f]{7,40}$/i;
+
+const isMultiRun = (v) => Array.isArray(v) && v.length > 0 && v.every(Array.isArray);
+
 export function validateManifest(manifest) {
   const prs = manifest && Array.isArray(manifest.prs) ? manifest.prs : null;
   if (!prs) throw new Error('manifest needs a "prs" array');
@@ -45,7 +59,9 @@ export function validateManifest(manifest) {
   prs.forEach((e, i) => {
     if (!e.repo || !Number.isInteger(e.pr)) throw new Error(`prs[${i}]: repo and integer pr are required`);
     if (e.expect !== 'buggy' && e.expect !== 'clean') throw new Error(`prs[${i}]: expect must be "buggy" or "clean"`);
-    const key = `${e.repo}#${e.pr}`;
+    if ('id' in e && (typeof e.id !== 'string' || !e.id)) throw new Error(`prs[${i}]: id must be a non-empty string`);
+    if ('sha' in e && (typeof e.sha !== 'string' || !SHA.test(e.sha))) throw new Error(`prs[${i}]: sha must be 7 to 40 hex characters`);
+    const key = caseKey(e);
     if (seen.has(key)) throw new Error(`prs[${i}]: duplicate entry ${key}`);
     seen.add(key);
     if (e.expect === 'buggy' && !parseKnownBug(e.knownBug)) {
@@ -57,25 +73,42 @@ export function validateManifest(manifest) {
 
 export function score(manifest, results) {
   const rows = validateManifest(manifest).map((e) => {
-    const key = `${e.repo}#${e.pr}`;
-    const findings = results[key];
-    if (!Array.isArray(findings)) return { key, expect: e.expect, scored: false };
-    if (e.expect === 'buggy') return { key, expect: 'buggy', scored: true, hit: isHit(findings, e.knownBug) };
+    const key = caseKey(e);
+    const value = results[key];
+    if (!Array.isArray(value)) return { key, expect: e.expect, scored: false };
+    const runs = isMultiRun(value) ? value : null;
+    if (e.expect === 'buggy') {
+      if (!runs) return { key, expect: 'buggy', scored: true, hit: isHit(value, e.knownBug) };
+      const hits = runs.filter((r) => isHit(r, e.knownBug)).length;
+      return { key, expect: 'buggy', scored: true, hit: hits > 0, runs: runs.length, hits, hitRate: hits / runs.length };
+    }
+    const fp = (r) => r.filter((f) => BLOCKING.has(f.severity)).length;
+    if (!runs) return { key, expect: 'clean', scored: true, falsePositives: fp(value) };
+    const perRun = runs.map(fp);
     return {
-      key, expect: 'clean', scored: true,
-      falsePositives: findings.filter((f) => BLOCKING.has(f.severity)).length,
+      key, expect: 'clean', scored: true, falsePositives: perRun.reduce((n, x) => n + x, 0),
+      runs: runs.length, falsePositivesPerRun: perRun,
     };
   });
   const buggy = rows.filter((r) => r.expect === 'buggy' && r.scored);
   const clean = rows.filter((r) => r.expect === 'clean' && r.scored);
-  return {
-    recall: buggy.length === 0 ? null : buggy.filter((r) => r.hit).length / buggy.length,
+  const buggyRuns = buggy.reduce((n, r) => n + (r.runs || 1), 0);
+  const cleanRuns = clean.reduce((n, r) => n + (r.runs || 1), 0);
+  const falsePositives = clean.reduce((n, r) => n + r.falsePositives, 0);
+  const out = {
+    recall: buggyRuns === 0 ? null : buggy.reduce((n, r) => n + (r.runs ? r.hits : Number(r.hit)), 0) / buggyRuns,
     buggyScored: buggy.length,
-    falsePositives: clean.reduce((n, r) => n + r.falsePositives, 0),
+    falsePositives,
     cleanScored: clean.length,
     unscored: rows.filter((r) => !r.scored).map((r) => r.key),
     rows,
   };
+  if (rows.some((r) => r.runs)) {
+    Object.assign(out, {
+      buggyRuns, cleanRuns, falsePositivesPerCleanRun: cleanRuns === 0 ? null : falsePositives / cleanRuns,
+    });
+  }
+  return out;
 }
 
 function main(argv) {
@@ -86,8 +119,13 @@ function main(argv) {
   }
   const out = score(JSON.parse(readFileSync(flag('manifest'), 'utf8')), JSON.parse(readFileSync(flag('results'), 'utf8')));
   if (argv.includes('--json')) { console.log(JSON.stringify(out)); return; }
-  const pct = out.recall === null ? 'n/a' : `${Math.round(out.recall * 100)}%`;
-  console.log(`recall ${pct} (${out.buggyScored} buggy scored), false positives ${out.falsePositives} (${out.cleanScored} clean scored), unscored ${out.unscored.length}`);
+  const pct = (x) => (x === null ? 'n/a' : `${Math.round(x * 100)}%`);
+  if (out.buggyRuns === undefined) {
+    console.log(`recall ${pct(out.recall)} (${out.buggyScored} buggy scored), false positives ${out.falsePositives} (${out.cleanScored} clean scored), unscored ${out.unscored.length}`);
+    return;
+  }
+  const perRun = out.falsePositivesPerCleanRun === null ? 'n/a' : out.falsePositivesPerCleanRun.toFixed(2);
+  console.log(`recall ${pct(out.recall)} per run (${out.buggyRuns} runs over ${out.buggyScored} buggy cases), false positives ${out.falsePositives} (${out.cleanRuns} runs over ${out.cleanScored} clean cases, ${perRun} per run), unscored ${out.unscored.length}`);
 }
 
 if (process.argv[1] === fileURLToPath(import.meta.url)) main(process.argv.slice(2));

package/plugins/olko-github-pr/skills/lekker-review/scripts/selftest.mjs

@@ -335,8 +335,8 @@ console.log('\ndeps depth: routing, classifier, line validation')
     const dimensionsFor = new Function(dimsSrc + '\nreturn dimensionsFor')()
     const M = { review: 'r', triage: 't' }
     check('deps runs exactly one agent', dimensionsFor('deps', M).map(d => d.file), ['deps.md'])
-    check('scan still runs the triage pair', dimensionsFor('scan', M).length, 2)
-    check('medium still runs five specialists', dimensionsFor('medium', M).length, 5)
+    check('scan runs the triage pair plus project-rules', dimensionsFor('scan', M).map(d => d.key), ['triage-quality', 'triage-logic', 'project-rules'])
+    check('medium runs five specialists plus project-rules', dimensionsFor('medium', M).length, 6)
     check('every dimension prompt file exists',
       ['deps', 'scan', 'medium'].flatMap(d => dimensionsFor(d, M)).every(d => existsSync(join(SKILL, 'references', 'agents', d.file))), true)
   }
@@ -871,7 +871,8 @@ function liftBlock(name) {
 const liftBlockOr = name => { try { return liftBlock(name) } catch { return `const ${name} = ''\n` } }
 const buildPrompt = new Function(
   'dim', 'SUPPRESSED', 'prevSha',
-  [liftBlockOr('PROJECT_RULE_DIMENSIONS'), liftBlockOr('PROJECT_RULE_INSTRUCTION'), liftConst('BUG_CLASS_INSTRUCTION'),
+  [liftBlockOr('PROJECT_RULE_DIMENSIONS'), liftBlockOr('PROJECT_RULE_CORE'), liftBlockOr('IGNORE_ENTRY_NOTE'),
+    liftBlockOr('PROJECT_RULE_INSTRUCTION'), liftBlockOr('PROJECT_RULE_ONLY_INSTRUCTION'), liftConst('BUG_CLASS_INSTRUCTION'),
     `const targetMetadata = '{}', promptDir = 'p', repoSlug = 'o/r', prNumber = 1, prUrl = 'u',
        diffFile = 'd', contextFile = 'c', wtDisplay = 'w'`,
     lift('reviewPrompt'), 'return reviewPrompt(dim)'].join('\n'),

package/plugins/olko-github-pr/skills/lekker-review/workflow.js

@@ -201,6 +201,11 @@ function sameIssue(a, b) {
       && qa !== '' && qb !== '' && qa !== qb) {
     return false
   }
+  // One authoritative rule quote is one breach, whatever each reviewer titled it or
+  // classed it. Location is still gated by the caller's file bucket and line window.
+  if (sameProjectQuote) {
+    return true
+  }
   // Merging two classes would send one class's instances to the other's fix.
   if (a.bugClass && b.bugClass && a.bugClass !== b.bugClass) {
     return false
@@ -222,9 +227,9 @@ const BUG_CLASS_INSTRUCTION = `BUG CLASS: give every finding a "bugClass" (short
   + ` "file:line" (empty array when there is none). Report the class, not just the first hit.`
 
 const PROJECT_RULE_DIMENSIONS = ['quality', 'implementation', 'simplification', 'conventions', 'test-quality',
-  'triage-quality', 'triage-logic']
+  'triage-quality', 'triage-logic', 'project-rules']
 
-const PROJECT_RULE_INSTRUCTION = `PROJECT RULES AS HARD RULES: read "projectRules" from CONTEXT_FILE.`
+const PROJECT_RULE_CORE = `PROJECT RULES AS HARD RULES: read "projectRules" from CONTEXT_FILE.`
   + ` When a changed line violates a project rule written as a prohibition or an obligation`
   + ` (NEVER, MUST, MUST NOT, ALWAYS, DO NOT, or a plain-English equivalent), raise a Critical`
   + ` finding with "rule" set to "PROJECT:<short-kebab-slug>", "ruleQuote" set to the exact`
@@ -234,8 +239,18 @@ const PROJECT_RULE_INSTRUCTION = `PROJECT RULES AS HARD RULES: read "projectRule
   + ` baseProjectRules, raise an Important finding with rule "weakens-project-rule" quoting`
   + ` the removed line. One finding per rule,`
   + ` with every other violating site in "otherInstances". Never quote a rule that is not in`
-  + ` the authoritative source ("baseProjectRules" when it is a string, otherwise "projectRules"). Preferences and suggestions are not hard rules: report them as ordinary`
-  + ` findings. A REVIEW.md ignore entry narrows where you look, it never disables a rule.`
+  + ` the authoritative source ("baseProjectRules" when it is a string, otherwise "projectRules").`
+
+const IGNORE_ENTRY_NOTE = ` A REVIEW.md ignore entry narrows where you look, it never disables a rule.`
+
+const PROJECT_RULE_INSTRUCTION = PROJECT_RULE_CORE
+  + ` Preferences and suggestions are not hard rules: report them as ordinary findings.`
+  + IGNORE_ENTRY_NOTE
+
+// The dedicated reviewer owns hard rules only, so it must not be told to emit preference findings.
+const PROJECT_RULE_ONLY_INSTRUCTION = PROJECT_RULE_CORE
+  + ` Preferences and suggestions are out of scope for you: do not report them.`
+  + IGNORE_ENTRY_NOTE
 
 const BUG_CLASS_PATTERN = /^[a-z0-9]+(-[a-z0-9]+)*$/
 const INSTANCE_PATTERN = new RegExp(INSTANCE_PATTERN_SOURCE)
@@ -397,7 +412,10 @@ function shouldVerify(finding, depth) {
 // Which reviewers run at each depth. `deps` is a PR whose only changes are
 // lockfiles and the dependency keys of package.json: five specialists would
 // produce a couple of notes that a single checklist agent covers, so it gets
-// exactly one.
+// exactly one. `project-rules` runs at every other depth: a rule sentence inside
+// a large rules file was missed when the check was only a side duty of generalist
+// agents. It always runs because the script cannot cheaply tell whether the
+// context holds rules; its prompt returns no findings when they are absent.
 function dimensionsFor(depth, MODEL) {
   if (depth === 'deps') {
     return [{ key: 'deps', file: 'deps.md', model: MODEL.review }]
@@ -406,6 +424,7 @@ function dimensionsFor(depth, MODEL) {
     return [
       { key: 'triage-quality', file: 'triage-quality.md', model: MODEL.triage },
       { key: 'triage-logic',   file: 'triage-logic.md',   model: MODEL.triage },
+      { key: 'project-rules',  file: 'project-rules.md',  model: MODEL.review },
     ]
   }
   return [
@@ -414,6 +433,7 @@ function dimensionsFor(depth, MODEL) {
     { key: 'simplification', file: 'simplification.md', model: MODEL.review },
     { key: 'conventions',    file: 'conventions.md',    model: MODEL.review },
     { key: 'test-quality',   file: 'test-quality.md',   model: MODEL.review },
+    { key: 'project-rules',  file: 'project-rules.md',  model: MODEL.review },
   ]
 }
 
@@ -586,14 +606,14 @@ if (ENGINE === 'revmux' && !findingsFile) {
   throw new Error('lekker-review workflow: engine "revmux" requires findingsFile (adapter output)')
 }
 
-// Concurrency. The review stage is self-limiting: five dimensions means five
+// Concurrency. The review stage is self-limiting: six dimensions means six
 // agents, so it runs them all at once. The other stages are not. Verify,
 // critic and prove spawn one agent PER FINDING, so a finding-heavy PR would
 // fan out far wider than the review that produced it, with no ceiling. Those
 // are capped at the review stage's own width.
 const REVIEW_PLAN = (Array.isArray(reviewBatchPlan) && reviewBatchPlan.length > 0)
   ? reviewBatchPlan
-  : [5]
+  : [6]
 const FANOUT_PLAN = [Math.max(1, maxConcurrent || 5)]
 const targetMetadata = JSON.stringify({ targetLabel })
 
@@ -678,7 +698,7 @@ const budgetAtStart = budget.spent()
     prompt += ' ' + BUG_CLASS_INSTRUCTION
 
     if (PROJECT_RULE_DIMENSIONS.includes(dim.key)) {
-      prompt += ' ' + PROJECT_RULE_INSTRUCTION
+      prompt += ' ' + (dim.key === 'project-rules' ? PROJECT_RULE_ONLY_INSTRUCTION : PROJECT_RULE_INSTRUCTION)
     }
 
     // The deterministic lint pre-flight has already collected every rule the

package/plugins/olko-obsidian/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-obsidian",
   "description": "Keep an Obsidian vault in sync with work: PR sync, task rollover, morning routine.",
-  "version": "1.72.0",
+  "version": "1.74.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-product/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-product",
   "description": "Take a product idea to a shippable build: MVP passes, full-stack scaffolds, UX/UI quality loops, launch plans.",
-  "version": "1.72.0",
+  "version": "1.74.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-reflection/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-reflection",
   "description": "Look back and improve: self-critique, retrospectives, performance review, rapid learning.",
-  "version": "1.72.0",
+  "version": "1.74.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-release/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-release",
   "description": "Ship a release: semantic-release setup, changelogs, store listing copy, release-day routine.",
-  "version": "1.72.0",
+  "version": "1.74.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-skill-meta/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-skill-meta",
   "description": "Author and maintain agent skills and the AI toolchain itself.",
-  "version": "1.72.0",
+  "version": "1.74.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-web-ops/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-web-ops",
   "description": "Operate a website: WAF rules, search console audits, analytics bootstrap, docs indexes.",
-  "version": "1.72.0",
+  "version": "1.74.0",
   "author": {
     "name": "Oleg Koval"
   },