@olegkoval/agent-skills 1.76.0 → 1.77.0

package/adapters/claude/olko-github-pr/skills/lekker-review/SKILL.md

@@ -511,9 +511,11 @@ ${SKILL_ROOT}/scripts/setup-worktree.sh \
 On completion, read `worktree.json`. Keys emitted:
 `worktreePath`, `repoRoot`, `headSha`, `headShaShort`, `tscTail`,
 `tscChangedTail`, `tscErrorCount`, `eslintTail`, `eslintScope`, `eslintJson`,
-`changedFiles`, `baseRef`, `mergeBase`, `projectRules`, `deltaFile`, `notes`,
+`eslintProvenance`, `changedFiles`, `baseRef`, `mergeBase`, `projectRules`, `deltaFile`, `notes`,
 `depsInstall`, `testRunner`.
 
+`eslintProvenance` is the provenance-only receipt for `eslintJson` (base/head, tracked-worktree state, exit code, raw report hash).
+
 `testRunner` is `{runner, dirs, reason}` from `scripts/test-runner.mjs`:
 `runner` is `vitest|jest|mocha|node-test` only when its binary is installed
 in the worktree, `dirs` lists `{dir, runner}` pairs for each usable package

package/adapters/claude/olko-github-pr/skills/lekker-review/scripts/codex-usage.mjs

@@ -0,0 +1,69 @@
+#!/usr/bin/env node
+import { createReadStream, readFileSync } from 'node:fs';
+import { createInterface } from 'node:readline';
+import { fileURLToPath } from 'node:url';
+
+const FIELDS = ['input_tokens', 'cached_input_tokens', 'cache_write_input_tokens', 'output_tokens', 'reasoning_output_tokens', 'total_tokens'];
+const record = v => v && typeof v === 'object' && !Array.isArray(v);
+const unavailable = (agentPath, reason) => ({ agentPath, status: 'unavailable', reason });
+
+async function inspectSession(sessionFile, parentThreadId, agentPath) {
+  let sessionId = null, usage = null, complete = false, models = [];
+  try {
+    const input = createReadStream(sessionFile);
+    for await (const line of createInterface({ input, crlfDelay: Infinity })) {
+      if (!line.trim()) continue;
+      let row;
+      try { row = JSON.parse(line); } catch { return unavailable(agentPath, 'malformed JSONL'); }
+      if (row.type === 'session_meta') {
+        const spawn = row.payload?.source?.subagent?.thread_spawn;
+        if (sessionId || typeof row.payload?.id !== 'string' || !row.payload.id) return unavailable(agentPath, 'session metadata missing or duplicated');
+        if (spawn?.parent_thread_id !== parentThreadId || spawn?.agent_path !== agentPath) return unavailable(agentPath, 'parent thread or agent path mismatch');
+        sessionId = row.payload.id;
+      } else if (row.type === 'turn_context' && typeof row.payload?.model === 'string' && row.payload.model && !models.includes(row.payload.model)) {
+        models = [...models, row.payload.model];
+      } else if (row.type === 'event_msg' && row.payload?.type === 'task_started') complete = false;
+      else if (row.type === 'event_msg' && row.payload?.type === 'task_complete') complete = true;
+      else if (row.type === 'event_msg' && row.payload?.type === 'token_count') {
+        const raw = row.payload.info?.total_token_usage;
+        if (!record(raw) || FIELDS.some(k => !Number.isSafeInteger(raw[k]) || raw[k] < 0)) return unavailable(agentPath, 'token counters are malformed');
+        const next = Object.fromEntries(FIELDS.map(k => [k, raw[k]]));
+        if (usage && FIELDS.some(k => next[k] < usage[k])) return unavailable(agentPath, 'token counters decreased');
+        usage = next;
+      }
+    }
+  } catch { return unavailable(agentPath, 'session file could not be read'); }
+  if (!sessionId) return unavailable(agentPath, 'session metadata unavailable');
+  if (!complete) return unavailable(agentPath, 'task completion unavailable');
+  if (!usage) return unavailable(agentPath, 'token counters unavailable');
+  return { agentPath, status: 'available', sessionId, models, usage };
+}
+
+export async function collectUsage(manifest) {
+  if (!record(manifest) || typeof manifest.parentThreadId !== 'string' || !manifest.parentThreadId
+      || !Array.isArray(manifest.agents) || !manifest.agents.length
+      || manifest.agents.some(a => !record(a) || typeof a.agentPath !== 'string' || !a.agentPath || typeof a.sessionFile !== 'string' || !a.sessionFile)) {
+    return { available: false, agents: [], totals: null, reason: 'manifest needs parentThreadId and explicit agentPath/sessionFile entries' };
+  }
+  const paths = manifest.agents.map(a => a.agentPath), files = manifest.agents.map(a => a.sessionFile);
+  if (paths.some((p, i) => paths.indexOf(p) !== i) || files.some((p, i) => files.indexOf(p) !== i)) {
+    return { available: false, agents: [], totals: null, reason: 'manifest repeats an agent path or session file' };
+  }
+  let agents = [];
+  for (const agent of manifest.agents) agents = [...agents, await inspectSession(agent.sessionFile, manifest.parentThreadId, agent.agentPath)];
+  const available = agents.every(a => a.status !== 'unavailable');
+  const totals = available ? Object.fromEntries(FIELDS.map(k => [k, agents.reduce((n, a) => n + a.usage[k], 0)])) : null;
+  const safe = totals && FIELDS.every(k => Number.isSafeInteger(totals[k]));
+  return { available: Boolean(safe), agents, totals: safe ? totals : null, ...(available && !safe ? { reason: 'aggregate token counters exceed safe integer range' } : {}) };
+}
+
+async function main(argv) {
+  const i = argv.indexOf('--manifest'), path = i < 0 ? null : argv[i + 1];
+  if (!path || path.startsWith('--')) { console.error('usage: codex-usage.mjs --manifest <explicit-sessions.json>'); process.exitCode = 2; return; }
+  let result;
+  try { result = await collectUsage(JSON.parse(readFileSync(path, 'utf8'))); }
+  catch { result = { available: false, agents: [], totals: null, reason: 'manifest could not be read' }; process.exitCode = 2; }
+  console.log(JSON.stringify(result));
+}
+
+if (process.argv[1] === fileURLToPath(import.meta.url)) main(process.argv.slice(2));

package/adapters/claude/olko-github-pr/skills/lekker-review/scripts/git-evidence.mjs

@@ -0,0 +1,39 @@
+import { createHash } from 'node:crypto';
+import { execFileSync } from 'node:child_process';
+import { TextDecoder } from 'node:util';
+import { riskPaths } from './risk-paths.mjs';
+
+const FULL_SHA = /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/i;
+const DIFF_FLAGS = ['--no-ext-diff', '--no-textconv', '--no-color', '--binary', '--no-renames', '--src-prefix=a/', '--dst-prefix=b/', '--full-index', '--unified=3', '--inter-hunk-context=0', '--diff-algorithm=myers', '--indent-heuristic', '--no-relative', '--ignore-submodules=none', '--submodule=short', '-O/dev/null'];
+const unavailable = reason => ({ schema: 1, status: 'unavailable', reason });
+const git = (cwd, args) => execFileSync('git', ['--no-replace-objects', '-c', 'core.quotePath=true', '-c', 'diff.suppressBlankEmpty=false', '-C', cwd, ...args], { stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: 64 * 1024 * 1024, env: Object.fromEntries(Object.entries(process.env).filter(([key]) => !key.startsWith('GIT_'))) });
+const fullSha = value => typeof value === 'string' && FULL_SHA.test(value);
+const headOf = cwd => git(cwd, ['rev-parse', '--verify', 'HEAD^{commit}']).toString('ascii').trim().toLowerCase();
+const trackedStatus = cwd => git(cwd, ['status', '--porcelain', '--untracked-files=no', '--ignore-submodules=none']);
+const flaggedIndex = cwd => git(cwd, ['ls-files', '-v', '-z']).toString().split('\0').some(row => /^[a-z] |^S /.test(row));
+
+export function collectGitEvidence({ worktreePath, mergeBase, headSha } = {}) {
+  if (typeof worktreePath !== 'string' || !worktreePath || !fullSha(mergeBase) || !fullSha(headSha)) return unavailable('worktree path or full commit SHA is invalid');
+  try {
+    const decoder = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true });
+    const baseSha = git(worktreePath, ['rev-parse', '--verify', `${mergeBase}^{commit}`]).toString('ascii').trim().toLowerCase();
+    if (baseSha !== mergeBase.toLowerCase()) return unavailable('merge base does not resolve to the pinned commit');
+    const headBefore = headOf(worktreePath);
+    if (headBefore !== headSha.toLowerCase()) return unavailable('worktree HEAD does not match pinned head');
+    if (flaggedIndex(worktreePath)) return unavailable('tracked index has assume-unchanged or skip-worktree entries before collection');
+    if (trackedStatus(worktreePath).length) return unavailable('tracked worktree is dirty before collection');
+    const rawDiff = git(worktreePath, ['diff', ...DIFF_FLAGS, baseSha, headBefore, '--']);
+    const rawPaths = git(worktreePath, ['diff', '--name-only', '-z', ...DIFF_FLAGS, baseSha, headBefore, '--']);
+    const headAfter = headOf(worktreePath);
+    if (headAfter !== headBefore) return unavailable('worktree HEAD changed during collection');
+    if (flaggedIndex(worktreePath)) return unavailable('tracked index gained assume-unchanged or skip-worktree entries during collection');
+    if (trackedStatus(worktreePath).length) return unavailable('tracked worktree became dirty during collection');
+    const changedPaths = rawPaths.toString('latin1').split('\0').filter(Boolean)
+      .map(path => decoder.decode(Buffer.from(path, 'latin1'))).sort();
+    const text = decoder.decode(rawDiff);
+    return { schema: 1, status: 'available', provenance: { baseSha, headSha: headAfter, trackedCleanBefore: true, trackedCleanAfter: true },
+      changedPaths, diff: { sha256: createHash('sha256').update(rawDiff).digest('hex'), text }, risk: riskPaths(changedPaths, text) };
+  } catch (error) {
+    return unavailable(error instanceof TypeError ? 'git evidence is not valid UTF-8' : 'git evidence command failed');
+  }
+}

package/adapters/claude/olko-github-pr/skills/lekker-review/scripts/revmux-adapter.mjs

@@ -5,6 +5,7 @@
 import { readFileSync } from 'node:fs'
 import { dirname, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
+import { bugClassOf, extractBadCode, mapSeverity } from './revmux-normalization.mjs'
 
 const args = process.argv.slice(2)
 const reportPath = args[0]
@@ -97,32 +98,6 @@ function extractRule(title) {
   return m && HARD_RULES.has(m[1]) ? m[1] : undefined
 }
 
-// revmux reports one location per finding and no class, so the class is derived
-// from the rule tag or title and no other instances are claimed.
-function bugClassOf(rule, title) {
-  const words = String(rule || title || '').toLowerCase().match(/[a-z0-9]+/g) || []
-  return words.slice(0, 6).join('-') || 'unclassified'
-}
-
-function mapSeverity(f) {
-  if (f.severity === 'critical') return 'critical'
-  if (f.severity === 'major') return 'important'
-  if (f.severity === 'minor') {
-    return (f.lenses || []).includes('lekker-conventions') ? 'idiomatic' : 'observation'
-  }
-  return 'observation'
-}
-
-// Pull an inline code snippet out of the body so hardRuleCorroborated has
-// something to check against; revmux findings carry no separate badCode field.
-function extractBadCode(body) {
-  const text = String(body || '')
-  const backtick = /`([^`]+)`/.exec(text)
-  if (backtick) return backtick[1]
-  const dashCode = /--\s*(.+)$/.exec(text.split('\n')[0])
-  return dashCode ? dashCode[1] : ''
-}
-
 const findings = []
 let droppedCount = 0
 let hardRuleCount = 0

package/adapters/claude/olko-github-pr/skills/lekker-review/scripts/revmux-normalization.mjs

@@ -0,0 +1,27 @@
+// revmux reports one location per finding and no class, so the class is derived
+// from the rule tag or title and no other instances are claimed.
+function bugClassOf(rule, title) {
+  const words = String(rule || title || '').toLowerCase().match(/[a-z0-9]+/g) || []
+  return words.slice(0, 6).join('-') || 'unclassified'
+}
+
+function mapSeverity(f) {
+  if (f.severity === 'critical') return 'critical'
+  if (f.severity === 'major') return 'important'
+  if (f.severity === 'minor') {
+    return (f.lenses || []).includes('lekker-conventions') ? 'idiomatic' : 'observation'
+  }
+  return 'observation'
+}
+
+// Pull an inline code snippet out of the body so hardRuleCorroborated has
+// something to check against; revmux findings carry no separate badCode field.
+function extractBadCode(body) {
+  const text = String(body || '')
+  const backtick = /`([^`]+)`/.exec(text)
+  if (backtick) return backtick[1]
+  const dashCode = /--\s*(.+)$/.exec(text.split('\n')[0])
+  return dashCode ? dashCode[1] : ''
+}
+
+export { bugClassOf, extractBadCode, mapSeverity }

package/adapters/claude/olko-github-pr/skills/lekker-review/scripts/run-log.mjs

@@ -27,7 +27,7 @@
 // `finish` may be called more than once for one run (after the review, again
 // after fix mode); every call appends a fresh row and the newest one wins.
 
-import { readFileSync, writeFileSync, appendFileSync, existsSync, mkdirSync, copyFileSync, readdirSync, statSync, rmSync } from 'node:fs';
+import { readFileSync, writeFileSync, appendFileSync, existsSync, mkdirSync, mkdtempSync, copyFileSync, readdirSync, statSync, rmSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { basename, join } from 'node:path';
 
@@ -152,9 +152,10 @@ if (cmd === 'start') {
   const target = flag('target');
   if (!repo || !target) fail('start needs --repo and --target');
   const startedAt = new Date().toISOString();
-  const runId = `${startedAt.replace(/[-:]/g, '').slice(0, 15)}-${slug(repo.split('/').pop())}-${slug(target)}`;
-  const dir = runDir(runId);
-  mkdirSync(dir, { recursive: true });
+  const prefix = `${startedAt.replace(/[-:]/g, '').slice(0, 15)}-${slug(repo.split('/').pop())}-${slug(target)}-`.slice(0, 249);
+  mkdirSync(RUNS_DIR, { recursive: true });
+  const dir = mkdtempSync(join(RUNS_DIR, prefix));
+  const runId = basename(dir);
   const meta = {
     schema: 1, runId, startedAt, repo, target,
     mode: flag('mode', 'pr'), depth: flag('depth'), engine: flag('engine', 'workflow'),

package/adapters/claude/olko-github-pr/skills/lekker-review/scripts/setup-worktree.sh

@@ -414,7 +414,9 @@ ESLINT_SCOPE_FILE="/tmp/lekker-eslint-scope-$$.txt"
 # temp files): lint-findings.mjs turns it into botPredicted findings, so the
 # review can fix what the bot reviewers would have charged for. Exported by
 # path as eslintJson.
-ESLINT_JSON_FILE="$(dirname "$OUT_JSON")/eslint-report.json"
+ESLINT_ARTIFACT_DIR="$(mktemp -d "$(dirname "$OUT_JSON")/eslint.XXXXXX")"
+ESLINT_JSON_FILE="$ESLINT_ARTIFACT_DIR/eslint-report.json"
+ESLINT_PROVENANCE_FILE="$ESLINT_JSON_FILE.provenance.json"
 printf '' > "$TSC_TAIL_FILE"
 printf '' > "$TSC_CHANGED_FILE"
 printf '0' > "$TSC_COUNT_FILE"
@@ -422,6 +424,37 @@ printf '' > "$ESLINT_TAIL_FILE"
 printf 'skipped' > "$ESLINT_SCOPE_FILE"
 printf '' > "$ESLINT_JSON_FILE"
 
+write_eslint_provenance() {
+    node - "$ESLINT_JSON_FILE" "$ESLINT_PROVENANCE_FILE" "$MERGE_BASE_VAL" "$@" <<'NODE' || rm -f "$ESLINT_PROVENANCE_FILE"
+const { createHash } = require('node:crypto')
+const fs = require('node:fs')
+const [reportPath, receiptPath, baseSha, headBefore, headAfter, cleanBefore, cleanAfter, rawExit] = process.argv.slice(2)
+const fullSha = value => /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/i.test(value || '')
+let bytes = null, validReport = false
+try {
+  bytes = fs.readFileSync(reportPath)
+  const report = JSON.parse(bytes.toString('utf8'))
+  validReport = bytes.length > 0 && Array.isArray(report) && report.length > 0
+    && report.every(file => file && typeof file.filePath === 'string' && file.filePath.trim() && Array.isArray(file.messages))
+} catch {}
+const exitCode = rawExit === '' ? null : Number(rawExit)
+const reasons = []
+if (!fullSha(baseSha)) reasons.push('invalid base SHA')
+if (!fullSha(headBefore) || headBefore !== headAfter) reasons.push('HEAD missing or changed during lint')
+if (cleanBefore !== 'true' || cleanAfter !== 'true') reasons.push('tracked worktree was dirty')
+if (exitCode !== 0 && exitCode !== 1) reasons.push('ESLint did not complete with a result')
+if (!validReport) reasons.push('ESLint report missing or malformed')
+fs.writeFileSync(receiptPath, JSON.stringify({
+  schema: 1, status: reasons.length ? 'unavailable' : 'available',
+  ...(reasons.length ? { reason: reasons.join('; ') } : {}),
+  baseSha: baseSha === 'null' ? null : baseSha,
+  headShaBefore: headBefore || null, headShaAfter: headAfter || null,
+  trackedCleanBefore: cleanBefore === 'true', trackedCleanAfter: cleanAfter === 'true',
+  exitCode, reportSha256: bytes ? createHash('sha256').update(bytes).digest('hex') : null,
+}, null, 2) + '\n')
+NODE
+}
+
 # Render a stylish-style tail from the JSON report. An empty or unparseable
 # report (eslint crashed, bad config) keeps whatever eslint wrote on stderr
 # instead of rendering "0 errors" from nothing.
@@ -473,7 +506,7 @@ run_tsc() {
 }
 
 run_eslint() {
-    local has_config
+    local has_config head_before='' head_after='' clean_before=false clean_after=false lint_exit='' tracked_state
     has_config=false
     if [[ "$NM_LINKED" == "true" ]]; then
         (cd "$WORKTREE_PATH" && compgen -G '.eslintrc*' >/dev/null 2>&1) && has_config=true
@@ -486,8 +519,17 @@ run_eslint() {
                     # One run, JSON formatter: the machine-readable report feeds
                     # lint-findings.mjs and the human tail is rendered from the
                     # same report, so the two can never disagree.
-                    (cd "$WORKTREE_PATH" && npx eslint --max-warnings=0 -f json -o "$ESLINT_JSON_FILE" "${ESLINT_TARGETS[@]}" 2> "$ESLINT_TAIL_FILE") || true
-                    render_eslint_tail
+                    head_before="$(git -C "$WORKTREE_PATH" rev-parse HEAD 2>/dev/null || true)"
+                    if tracked_state="$(git -C "$WORKTREE_PATH" status --porcelain=v1 --untracked-files=no 2>/dev/null)"; then
+                        [[ -z "$tracked_state" ]] && clean_before=true
+                    fi
+                    lint_exit=0
+                    (cd "$WORKTREE_PATH" && npx eslint --max-warnings=0 -f json -o "$ESLINT_JSON_FILE" "${ESLINT_TARGETS[@]}" 2> "$ESLINT_TAIL_FILE") || lint_exit=$?
+                    head_after="$(git -C "$WORKTREE_PATH" rev-parse HEAD 2>/dev/null || true)"
+                    if tracked_state="$(git -C "$WORKTREE_PATH" status --porcelain=v1 --untracked-files=no 2>/dev/null)"; then
+                        [[ -z "$tracked_state" ]] && clean_after=true
+                    fi
+                    render_eslint_tail || true
                     printf 'changed-files' > "$ESLINT_SCOPE_FILE"
                 else
                     printf 'no-changed-lintable-files\n' > "$ESLINT_TAIL_FILE"
@@ -508,6 +550,7 @@ run_eslint() {
         printf 'skipped\n' > "$ESLINT_TAIL_FILE"
         printf 'skipped' > "$ESLINT_SCOPE_FILE"
     fi
+    write_eslint_provenance "$head_before" "$head_after" "$clean_before" "$clean_after" "$lint_exit"
 }
 
 run_tsc &
@@ -582,6 +625,7 @@ python3 - \
     "$MERGE_BASE_VAL" \
     "$DEPS_INSTALL_FILE" \
     "$ESLINT_JSON_FILE" \
+    "$ESLINT_PROVENANCE_FILE" \
     "$TEST_RUNNER_JSON" \
     "$OUT_JSON" \
     "$BASE_RULES_FILE" \
@@ -592,8 +636,8 @@ import json, sys, os
  tsc_file, eslint_file, rules_file, delta_file, notes,
  changed_files_file, base_ref_val, eslint_scope_file,
  tsc_changed_file, tsc_count_file, merge_base_val,
- deps_install_file, eslint_json_file, test_runner_json, out_json,
- base_rules_file, base_rules_state) = sys.argv[1:22]
+ deps_install_file, eslint_json_file, eslint_provenance_file, test_runner_json, out_json,
+ base_rules_file, base_rules_state) = sys.argv[1:23]
 
 def parse_runner(raw):
     try:
@@ -665,6 +709,7 @@ data = {
     # no structured report (skipped, no config, crashed, or the repo-wide
     # fallback), so a consumer can tell "no lint report" from "no problems".
     "eslintJson":     eslint_json_file if file_has_content(eslint_json_file) else None,
+    "eslintProvenance": eslint_provenance_file if file_has_content(eslint_provenance_file) else None,
 }
 
 for p in (tsc_file, eslint_file, rules_file, base_rules_file, changed_files_file,

package/adapters/claude/olko-github-pr/skills/lekker-review/scripts/validate-lint-receipt.mjs

@@ -0,0 +1,33 @@
+import { createHash } from 'node:crypto'
+
+const FULL_SHA = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/i
+const HASH = /^[0-9a-f]{64}$/i
+const unavailable = reason => ({ status: 'unavailable', reason })
+
+export function validateLintReceipt(receipt, expected, reportBytes) {
+  if (!receipt || typeof receipt !== 'object' || Array.isArray(receipt)) return unavailable('receipt missing or malformed')
+  if (!expected || typeof expected !== 'object' || Array.isArray(expected)) return unavailable('expected provenance missing')
+  if (!(reportBytes instanceof Uint8Array)) return unavailable('raw lint report bytes unavailable')
+  if (typeof expected.baseSha !== 'string' || !FULL_SHA.test(expected.baseSha)
+      || typeof expected.headSha !== 'string' || !FULL_SHA.test(expected.headSha)) return unavailable('expected base/head must be full SHAs')
+  if (expected.trackedClean !== true) return unavailable('current tracked worktree is not clean')
+  if (receipt.schema !== 1) return unavailable('unsupported receipt schema')
+  if (receipt.status !== 'available') return unavailable(typeof receipt.reason === 'string' ? receipt.reason : 'receipt status is unavailable')
+  if (typeof receipt.baseSha !== 'string' || !FULL_SHA.test(receipt.baseSha)
+      || receipt.baseSha.toLowerCase() !== expected.baseSha.toLowerCase()) return unavailable('base SHA mismatch')
+  if (typeof receipt.headShaBefore !== 'string' || !FULL_SHA.test(receipt.headShaBefore)
+      || typeof receipt.headShaAfter !== 'string' || !FULL_SHA.test(receipt.headShaAfter)
+      || receipt.headShaBefore.toLowerCase() !== receipt.headShaAfter.toLowerCase()
+      || receipt.headShaBefore.toLowerCase() !== expected.headSha.toLowerCase()) return unavailable('head SHA mismatch or drift')
+  if (receipt.trackedCleanBefore !== true || receipt.trackedCleanAfter !== true) return unavailable('captured tracked worktree was not clean')
+  if (receipt.exitCode !== 0 && receipt.exitCode !== 1) return unavailable('invalid ESLint exit code')
+  if (typeof receipt.reportSha256 !== 'string' || !HASH.test(receipt.reportSha256)) return unavailable('report SHA-256 missing or malformed')
+  const reportSha256 = createHash('sha256').update(reportBytes).digest('hex')
+  if (reportSha256 !== receipt.reportSha256.toLowerCase()) return unavailable('lint report hash mismatch')
+  return {
+    status: 'available',
+    baseSha: receipt.baseSha, headSha: receipt.headShaBefore,
+    exitCode: receipt.exitCode, reportSha256,
+    trackedCleanBefore: receipt.trackedCleanBefore, trackedCleanAfter: receipt.trackedCleanAfter,
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@olegkoval/agent-skills",
-  "version": "1.76.0",
+  "version": "1.77.0",
   "private": false,
   "publishConfig": {
     "access": "public"

package/plugins/olko-apple-kit/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-apple-kit",
   "description": "Build and ship Apple platform apps: macOS menubar apps, App Store submissions.",
-  "version": "1.76.0",
+  "version": "1.77.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-creative/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-creative",
   "description": "Creative and personal projects: photo galleries, music players, listings, wiki editing.",
-  "version": "1.76.0",
+  "version": "1.77.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-garmin-kit/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-garmin-kit",
   "description": "Build, test and publish Garmin Connect IQ watch faces.",
-  "version": "1.76.0",
+  "version": "1.77.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-git-tools/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-git-tools",
   "description": "Everyday git and GitHub CLI operations: conventional commits, branch hygiene.",
-  "version": "1.76.0",
+  "version": "1.77.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-github-pr/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-github-pr",
   "description": "Drive GitHub pull requests to merge-ready: review-bot loops, CI fixes, descriptions, dependency triage.",
-  "version": "1.76.0",
+  "version": "1.77.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-github-pr/skills/lekker-review/SKILL.md

@@ -510,9 +510,11 @@ ${SKILL_ROOT}/scripts/setup-worktree.sh \
 On completion, read `worktree.json`. Keys emitted:
 `worktreePath`, `repoRoot`, `headSha`, `headShaShort`, `tscTail`,
 `tscChangedTail`, `tscErrorCount`, `eslintTail`, `eslintScope`, `eslintJson`,
-`changedFiles`, `baseRef`, `mergeBase`, `projectRules`, `deltaFile`, `notes`,
+`eslintProvenance`, `changedFiles`, `baseRef`, `mergeBase`, `projectRules`, `deltaFile`, `notes`,
 `depsInstall`, `testRunner`.
 
+`eslintProvenance` is the provenance-only receipt for `eslintJson` (base/head, tracked-worktree state, exit code, raw report hash).
+
 `testRunner` is `{runner, dirs, reason}` from `scripts/test-runner.mjs`:
 `runner` is `vitest|jest|mocha|node-test` only when its binary is installed
 in the worktree, `dirs` lists `{dir, runner}` pairs for each usable package

package/plugins/olko-github-pr/skills/lekker-review/scripts/codex-usage.mjs

@@ -0,0 +1,69 @@
+#!/usr/bin/env node
+import { createReadStream, readFileSync } from 'node:fs';
+import { createInterface } from 'node:readline';
+import { fileURLToPath } from 'node:url';
+
+const FIELDS = ['input_tokens', 'cached_input_tokens', 'cache_write_input_tokens', 'output_tokens', 'reasoning_output_tokens', 'total_tokens'];
+const record = v => v && typeof v === 'object' && !Array.isArray(v);
+const unavailable = (agentPath, reason) => ({ agentPath, status: 'unavailable', reason });
+
+async function inspectSession(sessionFile, parentThreadId, agentPath) {
+  let sessionId = null, usage = null, complete = false, models = [];
+  try {
+    const input = createReadStream(sessionFile);
+    for await (const line of createInterface({ input, crlfDelay: Infinity })) {
+      if (!line.trim()) continue;
+      let row;
+      try { row = JSON.parse(line); } catch { return unavailable(agentPath, 'malformed JSONL'); }
+      if (row.type === 'session_meta') {
+        const spawn = row.payload?.source?.subagent?.thread_spawn;
+        if (sessionId || typeof row.payload?.id !== 'string' || !row.payload.id) return unavailable(agentPath, 'session metadata missing or duplicated');
+        if (spawn?.parent_thread_id !== parentThreadId || spawn?.agent_path !== agentPath) return unavailable(agentPath, 'parent thread or agent path mismatch');
+        sessionId = row.payload.id;
+      } else if (row.type === 'turn_context' && typeof row.payload?.model === 'string' && row.payload.model && !models.includes(row.payload.model)) {
+        models = [...models, row.payload.model];
+      } else if (row.type === 'event_msg' && row.payload?.type === 'task_started') complete = false;
+      else if (row.type === 'event_msg' && row.payload?.type === 'task_complete') complete = true;
+      else if (row.type === 'event_msg' && row.payload?.type === 'token_count') {
+        const raw = row.payload.info?.total_token_usage;
+        if (!record(raw) || FIELDS.some(k => !Number.isSafeInteger(raw[k]) || raw[k] < 0)) return unavailable(agentPath, 'token counters are malformed');
+        const next = Object.fromEntries(FIELDS.map(k => [k, raw[k]]));
+        if (usage && FIELDS.some(k => next[k] < usage[k])) return unavailable(agentPath, 'token counters decreased');
+        usage = next;
+      }
+    }
+  } catch { return unavailable(agentPath, 'session file could not be read'); }
+  if (!sessionId) return unavailable(agentPath, 'session metadata unavailable');
+  if (!complete) return unavailable(agentPath, 'task completion unavailable');
+  if (!usage) return unavailable(agentPath, 'token counters unavailable');
+  return { agentPath, status: 'available', sessionId, models, usage };
+}
+
+export async function collectUsage(manifest) {
+  if (!record(manifest) || typeof manifest.parentThreadId !== 'string' || !manifest.parentThreadId
+      || !Array.isArray(manifest.agents) || !manifest.agents.length
+      || manifest.agents.some(a => !record(a) || typeof a.agentPath !== 'string' || !a.agentPath || typeof a.sessionFile !== 'string' || !a.sessionFile)) {
+    return { available: false, agents: [], totals: null, reason: 'manifest needs parentThreadId and explicit agentPath/sessionFile entries' };
+  }
+  const paths = manifest.agents.map(a => a.agentPath), files = manifest.agents.map(a => a.sessionFile);
+  if (paths.some((p, i) => paths.indexOf(p) !== i) || files.some((p, i) => files.indexOf(p) !== i)) {
+    return { available: false, agents: [], totals: null, reason: 'manifest repeats an agent path or session file' };
+  }
+  let agents = [];
+  for (const agent of manifest.agents) agents = [...agents, await inspectSession(agent.sessionFile, manifest.parentThreadId, agent.agentPath)];
+  const available = agents.every(a => a.status !== 'unavailable');
+  const totals = available ? Object.fromEntries(FIELDS.map(k => [k, agents.reduce((n, a) => n + a.usage[k], 0)])) : null;
+  const safe = totals && FIELDS.every(k => Number.isSafeInteger(totals[k]));
+  return { available: Boolean(safe), agents, totals: safe ? totals : null, ...(available && !safe ? { reason: 'aggregate token counters exceed safe integer range' } : {}) };
+}
+
+async function main(argv) {
+  const i = argv.indexOf('--manifest'), path = i < 0 ? null : argv[i + 1];
+  if (!path || path.startsWith('--')) { console.error('usage: codex-usage.mjs --manifest <explicit-sessions.json>'); process.exitCode = 2; return; }
+  let result;
+  try { result = await collectUsage(JSON.parse(readFileSync(path, 'utf8'))); }
+  catch { result = { available: false, agents: [], totals: null, reason: 'manifest could not be read' }; process.exitCode = 2; }
+  console.log(JSON.stringify(result));
+}
+
+if (process.argv[1] === fileURLToPath(import.meta.url)) main(process.argv.slice(2));

package/plugins/olko-github-pr/skills/lekker-review/scripts/git-evidence.mjs

@@ -0,0 +1,39 @@
+import { createHash } from 'node:crypto';
+import { execFileSync } from 'node:child_process';
+import { TextDecoder } from 'node:util';
+import { riskPaths } from './risk-paths.mjs';
+
+const FULL_SHA = /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/i;
+const DIFF_FLAGS = ['--no-ext-diff', '--no-textconv', '--no-color', '--binary', '--no-renames', '--src-prefix=a/', '--dst-prefix=b/', '--full-index', '--unified=3', '--inter-hunk-context=0', '--diff-algorithm=myers', '--indent-heuristic', '--no-relative', '--ignore-submodules=none', '--submodule=short', '-O/dev/null'];
+const unavailable = reason => ({ schema: 1, status: 'unavailable', reason });
+const git = (cwd, args) => execFileSync('git', ['--no-replace-objects', '-c', 'core.quotePath=true', '-c', 'diff.suppressBlankEmpty=false', '-C', cwd, ...args], { stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: 64 * 1024 * 1024, env: Object.fromEntries(Object.entries(process.env).filter(([key]) => !key.startsWith('GIT_'))) });
+const fullSha = value => typeof value === 'string' && FULL_SHA.test(value);
+const headOf = cwd => git(cwd, ['rev-parse', '--verify', 'HEAD^{commit}']).toString('ascii').trim().toLowerCase();
+const trackedStatus = cwd => git(cwd, ['status', '--porcelain', '--untracked-files=no', '--ignore-submodules=none']);
+const flaggedIndex = cwd => git(cwd, ['ls-files', '-v', '-z']).toString().split('\0').some(row => /^[a-z] |^S /.test(row));
+
+export function collectGitEvidence({ worktreePath, mergeBase, headSha } = {}) {
+  if (typeof worktreePath !== 'string' || !worktreePath || !fullSha(mergeBase) || !fullSha(headSha)) return unavailable('worktree path or full commit SHA is invalid');
+  try {
+    const decoder = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true });
+    const baseSha = git(worktreePath, ['rev-parse', '--verify', `${mergeBase}^{commit}`]).toString('ascii').trim().toLowerCase();
+    if (baseSha !== mergeBase.toLowerCase()) return unavailable('merge base does not resolve to the pinned commit');
+    const headBefore = headOf(worktreePath);
+    if (headBefore !== headSha.toLowerCase()) return unavailable('worktree HEAD does not match pinned head');
+    if (flaggedIndex(worktreePath)) return unavailable('tracked index has assume-unchanged or skip-worktree entries before collection');
+    if (trackedStatus(worktreePath).length) return unavailable('tracked worktree is dirty before collection');
+    const rawDiff = git(worktreePath, ['diff', ...DIFF_FLAGS, baseSha, headBefore, '--']);
+    const rawPaths = git(worktreePath, ['diff', '--name-only', '-z', ...DIFF_FLAGS, baseSha, headBefore, '--']);
+    const headAfter = headOf(worktreePath);
+    if (headAfter !== headBefore) return unavailable('worktree HEAD changed during collection');
+    if (flaggedIndex(worktreePath)) return unavailable('tracked index gained assume-unchanged or skip-worktree entries during collection');
+    if (trackedStatus(worktreePath).length) return unavailable('tracked worktree became dirty during collection');
+    const changedPaths = rawPaths.toString('latin1').split('\0').filter(Boolean)
+      .map(path => decoder.decode(Buffer.from(path, 'latin1'))).sort();
+    const text = decoder.decode(rawDiff);
+    return { schema: 1, status: 'available', provenance: { baseSha, headSha: headAfter, trackedCleanBefore: true, trackedCleanAfter: true },
+      changedPaths, diff: { sha256: createHash('sha256').update(rawDiff).digest('hex'), text }, risk: riskPaths(changedPaths, text) };
+  } catch (error) {
+    return unavailable(error instanceof TypeError ? 'git evidence is not valid UTF-8' : 'git evidence command failed');
+  }
+}

package/plugins/olko-github-pr/skills/lekker-review/scripts/revmux-adapter.mjs

@@ -5,6 +5,7 @@
 import { readFileSync } from 'node:fs'
 import { dirname, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
+import { bugClassOf, extractBadCode, mapSeverity } from './revmux-normalization.mjs'
 
 const args = process.argv.slice(2)
 const reportPath = args[0]
@@ -97,32 +98,6 @@ function extractRule(title) {
   return m && HARD_RULES.has(m[1]) ? m[1] : undefined
 }
 
-// revmux reports one location per finding and no class, so the class is derived
-// from the rule tag or title and no other instances are claimed.
-function bugClassOf(rule, title) {
-  const words = String(rule || title || '').toLowerCase().match(/[a-z0-9]+/g) || []
-  return words.slice(0, 6).join('-') || 'unclassified'
-}
-
-function mapSeverity(f) {
-  if (f.severity === 'critical') return 'critical'
-  if (f.severity === 'major') return 'important'
-  if (f.severity === 'minor') {
-    return (f.lenses || []).includes('lekker-conventions') ? 'idiomatic' : 'observation'
-  }
-  return 'observation'
-}
-
-// Pull an inline code snippet out of the body so hardRuleCorroborated has
-// something to check against; revmux findings carry no separate badCode field.
-function extractBadCode(body) {
-  const text = String(body || '')
-  const backtick = /`([^`]+)`/.exec(text)
-  if (backtick) return backtick[1]
-  const dashCode = /--\s*(.+)$/.exec(text.split('\n')[0])
-  return dashCode ? dashCode[1] : ''
-}
-
 const findings = []
 let droppedCount = 0
 let hardRuleCount = 0

package/plugins/olko-github-pr/skills/lekker-review/scripts/revmux-normalization.mjs

@@ -0,0 +1,27 @@
+// revmux reports one location per finding and no class, so the class is derived
+// from the rule tag or title and no other instances are claimed.
+function bugClassOf(rule, title) {
+  const words = String(rule || title || '').toLowerCase().match(/[a-z0-9]+/g) || []
+  return words.slice(0, 6).join('-') || 'unclassified'
+}
+
+function mapSeverity(f) {
+  if (f.severity === 'critical') return 'critical'
+  if (f.severity === 'major') return 'important'
+  if (f.severity === 'minor') {
+    return (f.lenses || []).includes('lekker-conventions') ? 'idiomatic' : 'observation'
+  }
+  return 'observation'
+}
+
+// Pull an inline code snippet out of the body so hardRuleCorroborated has
+// something to check against; revmux findings carry no separate badCode field.
+function extractBadCode(body) {
+  const text = String(body || '')
+  const backtick = /`([^`]+)`/.exec(text)
+  if (backtick) return backtick[1]
+  const dashCode = /--\s*(.+)$/.exec(text.split('\n')[0])
+  return dashCode ? dashCode[1] : ''
+}
+
+export { bugClassOf, extractBadCode, mapSeverity }

package/plugins/olko-github-pr/skills/lekker-review/scripts/run-log.mjs

@@ -27,7 +27,7 @@
 // `finish` may be called more than once for one run (after the review, again
 // after fix mode); every call appends a fresh row and the newest one wins.
 
-import { readFileSync, writeFileSync, appendFileSync, existsSync, mkdirSync, copyFileSync, readdirSync, statSync, rmSync } from 'node:fs';
+import { readFileSync, writeFileSync, appendFileSync, existsSync, mkdirSync, mkdtempSync, copyFileSync, readdirSync, statSync, rmSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { basename, join } from 'node:path';
 
@@ -152,9 +152,10 @@ if (cmd === 'start') {
   const target = flag('target');
   if (!repo || !target) fail('start needs --repo and --target');
   const startedAt = new Date().toISOString();
-  const runId = `${startedAt.replace(/[-:]/g, '').slice(0, 15)}-${slug(repo.split('/').pop())}-${slug(target)}`;
-  const dir = runDir(runId);
-  mkdirSync(dir, { recursive: true });
+  const prefix = `${startedAt.replace(/[-:]/g, '').slice(0, 15)}-${slug(repo.split('/').pop())}-${slug(target)}-`.slice(0, 249);
+  mkdirSync(RUNS_DIR, { recursive: true });
+  const dir = mkdtempSync(join(RUNS_DIR, prefix));
+  const runId = basename(dir);
   const meta = {
     schema: 1, runId, startedAt, repo, target,
     mode: flag('mode', 'pr'), depth: flag('depth'), engine: flag('engine', 'workflow'),

package/plugins/olko-github-pr/skills/lekker-review/scripts/setup-worktree.sh

@@ -414,7 +414,9 @@ ESLINT_SCOPE_FILE="/tmp/lekker-eslint-scope-$$.txt"
 # temp files): lint-findings.mjs turns it into botPredicted findings, so the
 # review can fix what the bot reviewers would have charged for. Exported by
 # path as eslintJson.
-ESLINT_JSON_FILE="$(dirname "$OUT_JSON")/eslint-report.json"
+ESLINT_ARTIFACT_DIR="$(mktemp -d "$(dirname "$OUT_JSON")/eslint.XXXXXX")"
+ESLINT_JSON_FILE="$ESLINT_ARTIFACT_DIR/eslint-report.json"
+ESLINT_PROVENANCE_FILE="$ESLINT_JSON_FILE.provenance.json"
 printf '' > "$TSC_TAIL_FILE"
 printf '' > "$TSC_CHANGED_FILE"
 printf '0' > "$TSC_COUNT_FILE"
@@ -422,6 +424,37 @@ printf '' > "$ESLINT_TAIL_FILE"
 printf 'skipped' > "$ESLINT_SCOPE_FILE"
 printf '' > "$ESLINT_JSON_FILE"
 
+write_eslint_provenance() {
+    node - "$ESLINT_JSON_FILE" "$ESLINT_PROVENANCE_FILE" "$MERGE_BASE_VAL" "$@" <<'NODE' || rm -f "$ESLINT_PROVENANCE_FILE"
+const { createHash } = require('node:crypto')
+const fs = require('node:fs')
+const [reportPath, receiptPath, baseSha, headBefore, headAfter, cleanBefore, cleanAfter, rawExit] = process.argv.slice(2)
+const fullSha = value => /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/i.test(value || '')
+let bytes = null, validReport = false
+try {
+  bytes = fs.readFileSync(reportPath)
+  const report = JSON.parse(bytes.toString('utf8'))
+  validReport = bytes.length > 0 && Array.isArray(report) && report.length > 0
+    && report.every(file => file && typeof file.filePath === 'string' && file.filePath.trim() && Array.isArray(file.messages))
+} catch {}
+const exitCode = rawExit === '' ? null : Number(rawExit)
+const reasons = []
+if (!fullSha(baseSha)) reasons.push('invalid base SHA')
+if (!fullSha(headBefore) || headBefore !== headAfter) reasons.push('HEAD missing or changed during lint')
+if (cleanBefore !== 'true' || cleanAfter !== 'true') reasons.push('tracked worktree was dirty')
+if (exitCode !== 0 && exitCode !== 1) reasons.push('ESLint did not complete with a result')
+if (!validReport) reasons.push('ESLint report missing or malformed')
+fs.writeFileSync(receiptPath, JSON.stringify({
+  schema: 1, status: reasons.length ? 'unavailable' : 'available',
+  ...(reasons.length ? { reason: reasons.join('; ') } : {}),
+  baseSha: baseSha === 'null' ? null : baseSha,
+  headShaBefore: headBefore || null, headShaAfter: headAfter || null,
+  trackedCleanBefore: cleanBefore === 'true', trackedCleanAfter: cleanAfter === 'true',
+  exitCode, reportSha256: bytes ? createHash('sha256').update(bytes).digest('hex') : null,
+}, null, 2) + '\n')
+NODE
+}
+
 # Render a stylish-style tail from the JSON report. An empty or unparseable
 # report (eslint crashed, bad config) keeps whatever eslint wrote on stderr
 # instead of rendering "0 errors" from nothing.
@@ -473,7 +506,7 @@ run_tsc() {
 }
 
 run_eslint() {
-    local has_config
+    local has_config head_before='' head_after='' clean_before=false clean_after=false lint_exit='' tracked_state
     has_config=false
     if [[ "$NM_LINKED" == "true" ]]; then
         (cd "$WORKTREE_PATH" && compgen -G '.eslintrc*' >/dev/null 2>&1) && has_config=true
@@ -486,8 +519,17 @@ run_eslint() {
                     # One run, JSON formatter: the machine-readable report feeds
                     # lint-findings.mjs and the human tail is rendered from the
                     # same report, so the two can never disagree.
-                    (cd "$WORKTREE_PATH" && npx eslint --max-warnings=0 -f json -o "$ESLINT_JSON_FILE" "${ESLINT_TARGETS[@]}" 2> "$ESLINT_TAIL_FILE") || true
-                    render_eslint_tail
+                    head_before="$(git -C "$WORKTREE_PATH" rev-parse HEAD 2>/dev/null || true)"
+                    if tracked_state="$(git -C "$WORKTREE_PATH" status --porcelain=v1 --untracked-files=no 2>/dev/null)"; then
+                        [[ -z "$tracked_state" ]] && clean_before=true
+                    fi
+                    lint_exit=0
+                    (cd "$WORKTREE_PATH" && npx eslint --max-warnings=0 -f json -o "$ESLINT_JSON_FILE" "${ESLINT_TARGETS[@]}" 2> "$ESLINT_TAIL_FILE") || lint_exit=$?
+                    head_after="$(git -C "$WORKTREE_PATH" rev-parse HEAD 2>/dev/null || true)"
+                    if tracked_state="$(git -C "$WORKTREE_PATH" status --porcelain=v1 --untracked-files=no 2>/dev/null)"; then
+                        [[ -z "$tracked_state" ]] && clean_after=true
+                    fi
+                    render_eslint_tail || true
                     printf 'changed-files' > "$ESLINT_SCOPE_FILE"
                 else
                     printf 'no-changed-lintable-files\n' > "$ESLINT_TAIL_FILE"
@@ -508,6 +550,7 @@ run_eslint() {
         printf 'skipped\n' > "$ESLINT_TAIL_FILE"
         printf 'skipped' > "$ESLINT_SCOPE_FILE"
     fi
+    write_eslint_provenance "$head_before" "$head_after" "$clean_before" "$clean_after" "$lint_exit"
 }
 
 run_tsc &
@@ -582,6 +625,7 @@ python3 - \
     "$MERGE_BASE_VAL" \
     "$DEPS_INSTALL_FILE" \
     "$ESLINT_JSON_FILE" \
+    "$ESLINT_PROVENANCE_FILE" \
     "$TEST_RUNNER_JSON" \
     "$OUT_JSON" \
     "$BASE_RULES_FILE" \
@@ -592,8 +636,8 @@ import json, sys, os
  tsc_file, eslint_file, rules_file, delta_file, notes,
  changed_files_file, base_ref_val, eslint_scope_file,
  tsc_changed_file, tsc_count_file, merge_base_val,
- deps_install_file, eslint_json_file, test_runner_json, out_json,
- base_rules_file, base_rules_state) = sys.argv[1:22]
+ deps_install_file, eslint_json_file, eslint_provenance_file, test_runner_json, out_json,
+ base_rules_file, base_rules_state) = sys.argv[1:23]
 
 def parse_runner(raw):
     try:
@@ -665,6 +709,7 @@ data = {
     # no structured report (skipped, no config, crashed, or the repo-wide
     # fallback), so a consumer can tell "no lint report" from "no problems".
     "eslintJson":     eslint_json_file if file_has_content(eslint_json_file) else None,
+    "eslintProvenance": eslint_provenance_file if file_has_content(eslint_provenance_file) else None,
 }
 
 for p in (tsc_file, eslint_file, rules_file, base_rules_file, changed_files_file,

package/plugins/olko-github-pr/skills/lekker-review/scripts/validate-lint-receipt.mjs

@@ -0,0 +1,33 @@
+import { createHash } from 'node:crypto'
+
+const FULL_SHA = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/i
+const HASH = /^[0-9a-f]{64}$/i
+const unavailable = reason => ({ status: 'unavailable', reason })
+
+export function validateLintReceipt(receipt, expected, reportBytes) {
+  if (!receipt || typeof receipt !== 'object' || Array.isArray(receipt)) return unavailable('receipt missing or malformed')
+  if (!expected || typeof expected !== 'object' || Array.isArray(expected)) return unavailable('expected provenance missing')
+  if (!(reportBytes instanceof Uint8Array)) return unavailable('raw lint report bytes unavailable')
+  if (typeof expected.baseSha !== 'string' || !FULL_SHA.test(expected.baseSha)
+      || typeof expected.headSha !== 'string' || !FULL_SHA.test(expected.headSha)) return unavailable('expected base/head must be full SHAs')
+  if (expected.trackedClean !== true) return unavailable('current tracked worktree is not clean')
+  if (receipt.schema !== 1) return unavailable('unsupported receipt schema')
+  if (receipt.status !== 'available') return unavailable(typeof receipt.reason === 'string' ? receipt.reason : 'receipt status is unavailable')
+  if (typeof receipt.baseSha !== 'string' || !FULL_SHA.test(receipt.baseSha)
+      || receipt.baseSha.toLowerCase() !== expected.baseSha.toLowerCase()) return unavailable('base SHA mismatch')
+  if (typeof receipt.headShaBefore !== 'string' || !FULL_SHA.test(receipt.headShaBefore)
+      || typeof receipt.headShaAfter !== 'string' || !FULL_SHA.test(receipt.headShaAfter)
+      || receipt.headShaBefore.toLowerCase() !== receipt.headShaAfter.toLowerCase()
+      || receipt.headShaBefore.toLowerCase() !== expected.headSha.toLowerCase()) return unavailable('head SHA mismatch or drift')
+  if (receipt.trackedCleanBefore !== true || receipt.trackedCleanAfter !== true) return unavailable('captured tracked worktree was not clean')
+  if (receipt.exitCode !== 0 && receipt.exitCode !== 1) return unavailable('invalid ESLint exit code')
+  if (typeof receipt.reportSha256 !== 'string' || !HASH.test(receipt.reportSha256)) return unavailable('report SHA-256 missing or malformed')
+  const reportSha256 = createHash('sha256').update(reportBytes).digest('hex')
+  if (reportSha256 !== receipt.reportSha256.toLowerCase()) return unavailable('lint report hash mismatch')
+  return {
+    status: 'available',
+    baseSha: receipt.baseSha, headSha: receipt.headShaBefore,
+    exitCode: receipt.exitCode, reportSha256,
+    trackedCleanBefore: receipt.trackedCleanBefore, trackedCleanAfter: receipt.trackedCleanAfter,
+  }
+}

package/plugins/olko-obsidian/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-obsidian",
   "description": "Keep an Obsidian vault in sync with work: PR sync, task rollover, morning routine.",
-  "version": "1.76.0",
+  "version": "1.77.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-product/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-product",
   "description": "Take a product idea to a shippable build: MVP passes, full-stack scaffolds, UX/UI quality loops, launch plans.",
-  "version": "1.76.0",
+  "version": "1.77.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-reflection/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-reflection",
   "description": "Look back and improve: self-critique, retrospectives, performance review, rapid learning.",
-  "version": "1.76.0",
+  "version": "1.77.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-release/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-release",
   "description": "Ship a release: semantic-release setup, changelogs, store listing copy, release-day routine.",
-  "version": "1.76.0",
+  "version": "1.77.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-skill-meta/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-skill-meta",
   "description": "Author and maintain agent skills and the AI toolchain itself.",
-  "version": "1.76.0",
+  "version": "1.77.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-web-ops/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-web-ops",
   "description": "Operate a website: WAF rules, search console audits, analytics bootstrap, docs indexes.",
-  "version": "1.76.0",
+  "version": "1.77.0",
   "author": {
     "name": "Oleg Koval"
   },