@olegkoval/agent-skills 1.76.0 → 1.78.0

package/adapters/claude/olko-github-pr/skills/lekker-review/SKILL.md

@@ -511,9 +511,11 @@ ${SKILL_ROOT}/scripts/setup-worktree.sh \
 On completion, read `worktree.json`. Keys emitted:
 `worktreePath`, `repoRoot`, `headSha`, `headShaShort`, `tscTail`,
 `tscChangedTail`, `tscErrorCount`, `eslintTail`, `eslintScope`, `eslintJson`,
-`changedFiles`, `baseRef`, `mergeBase`, `projectRules`, `deltaFile`, `notes`,
+`eslintProvenance`, `changedFiles`, `baseRef`, `mergeBase`, `projectRules`, `deltaFile`, `notes`,
 `depsInstall`, `testRunner`.
 
+`eslintProvenance` is the provenance-only receipt for `eslintJson` (base/head, tracked-worktree state, exit code, raw report hash).
+
 `testRunner` is `{runner, dirs, reason}` from `scripts/test-runner.mjs`:
 `runner` is `vitest|jest|mocha|node-test` only when its binary is installed
 in the worktree, `dirs` lists `{dir, runner}` pairs for each usable package

package/adapters/claude/olko-github-pr/skills/lekker-review/scripts/codex-usage.mjs

@@ -0,0 +1,69 @@
+#!/usr/bin/env node
+import { createReadStream, readFileSync } from 'node:fs';
+import { createInterface } from 'node:readline';
+import { fileURLToPath } from 'node:url';
+
+const FIELDS = ['input_tokens', 'cached_input_tokens', 'cache_write_input_tokens', 'output_tokens', 'reasoning_output_tokens', 'total_tokens'];
+const record = v => v && typeof v === 'object' && !Array.isArray(v);
+const unavailable = (agentPath, reason) => ({ agentPath, status: 'unavailable', reason });
+
+async function inspectSession(sessionFile, parentThreadId, agentPath) {
+  let sessionId = null, usage = null, complete = false, models = [];
+  try {
+    const input = createReadStream(sessionFile);
+    for await (const line of createInterface({ input, crlfDelay: Infinity })) {
+      if (!line.trim()) continue;
+      let row;
+      try { row = JSON.parse(line); } catch { return unavailable(agentPath, 'malformed JSONL'); }
+      if (row.type === 'session_meta') {
+        const spawn = row.payload?.source?.subagent?.thread_spawn;
+        if (sessionId || typeof row.payload?.id !== 'string' || !row.payload.id) return unavailable(agentPath, 'session metadata missing or duplicated');
+        if (spawn?.parent_thread_id !== parentThreadId || spawn?.agent_path !== agentPath) return unavailable(agentPath, 'parent thread or agent path mismatch');
+        sessionId = row.payload.id;
+      } else if (row.type === 'turn_context' && typeof row.payload?.model === 'string' && row.payload.model && !models.includes(row.payload.model)) {
+        models = [...models, row.payload.model];
+      } else if (row.type === 'event_msg' && row.payload?.type === 'task_started') complete = false;
+      else if (row.type === 'event_msg' && row.payload?.type === 'task_complete') complete = true;
+      else if (row.type === 'event_msg' && row.payload?.type === 'token_count') {
+        const raw = row.payload.info?.total_token_usage;
+        if (!record(raw) || FIELDS.some(k => !Number.isSafeInteger(raw[k]) || raw[k] < 0)) return unavailable(agentPath, 'token counters are malformed');
+        const next = Object.fromEntries(FIELDS.map(k => [k, raw[k]]));
+        if (usage && FIELDS.some(k => next[k] < usage[k])) return unavailable(agentPath, 'token counters decreased');
+        usage = next;
+      }
+    }
+  } catch { return unavailable(agentPath, 'session file could not be read'); }
+  if (!sessionId) return unavailable(agentPath, 'session metadata unavailable');
+  if (!complete) return unavailable(agentPath, 'task completion unavailable');
+  if (!usage) return unavailable(agentPath, 'token counters unavailable');
+  return { agentPath, status: 'available', sessionId, models, usage };
+}
+
+export async function collectUsage(manifest) {
+  if (!record(manifest) || typeof manifest.parentThreadId !== 'string' || !manifest.parentThreadId
+      || !Array.isArray(manifest.agents) || !manifest.agents.length
+      || manifest.agents.some(a => !record(a) || typeof a.agentPath !== 'string' || !a.agentPath || typeof a.sessionFile !== 'string' || !a.sessionFile)) {
+    return { available: false, agents: [], totals: null, reason: 'manifest needs parentThreadId and explicit agentPath/sessionFile entries' };
+  }
+  const paths = manifest.agents.map(a => a.agentPath), files = manifest.agents.map(a => a.sessionFile);
+  if (paths.some((p, i) => paths.indexOf(p) !== i) || files.some((p, i) => files.indexOf(p) !== i)) {
+    return { available: false, agents: [], totals: null, reason: 'manifest repeats an agent path or session file' };
+  }
+  let agents = [];
+  for (const agent of manifest.agents) agents = [...agents, await inspectSession(agent.sessionFile, manifest.parentThreadId, agent.agentPath)];
+  const available = agents.every(a => a.status !== 'unavailable');
+  const totals = available ? Object.fromEntries(FIELDS.map(k => [k, agents.reduce((n, a) => n + a.usage[k], 0)])) : null;
+  const safe = totals && FIELDS.every(k => Number.isSafeInteger(totals[k]));
+  return { available: Boolean(safe), agents, totals: safe ? totals : null, ...(available && !safe ? { reason: 'aggregate token counters exceed safe integer range' } : {}) };
+}
+
+async function main(argv) {
+  const i = argv.indexOf('--manifest'), path = i < 0 ? null : argv[i + 1];
+  if (!path || path.startsWith('--')) { console.error('usage: codex-usage.mjs --manifest <explicit-sessions.json>'); process.exitCode = 2; return; }
+  let result;
+  try { result = await collectUsage(JSON.parse(readFileSync(path, 'utf8'))); }
+  catch { result = { available: false, agents: [], totals: null, reason: 'manifest could not be read' }; process.exitCode = 2; }
+  console.log(JSON.stringify(result));
+}
+
+if (process.argv[1] === fileURLToPath(import.meta.url)) main(process.argv.slice(2));

package/adapters/claude/olko-github-pr/skills/lekker-review/scripts/eval-runner.mjs

@@ -2,7 +2,7 @@
 // Score lekker findings against a manifest of PRs with known outcomes.
 //
 // Usage:
-//   node eval-runner.mjs --manifest evals/manifest.json --results <results.json> [--json]
+//   node eval-runner.mjs --manifest <manifest.json> (--results <results.json> | --archive <runs-dir>) [--json]
 //
 // manifest.json: { prs: [{ repo, pr, expect: "buggy"|"clean", knownBug?: "file:line + description", id?, sha? }] }
 //                The case key is `id` when present, else "<repo>#<pr>@<sha>" when `sha` is
@@ -21,6 +21,7 @@
 // verdict-affecting finding (critical or important) is a false positive.
 
 import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 export const LINE_WINDOW = 10;
@@ -74,6 +75,7 @@ export function validateManifest(manifest) {
   return prs;
 }
 
+/** Normalize archived review evidence, returning findings only when every identity check passes. */
 export function normalizeArchivedEvidence(entry, run, worktree, document) {
   const key = caseKey(entry);
   const unscored = (reason) => ({ key, reason });
@@ -98,6 +100,7 @@ export function normalizeArchivedEvidence(entry, run, worktree, document) {
 }
 
 // Validate archive references before reading any run directories.
+/** Reject duplicate archive run IDs before archive paths are read. */
 export function validateArchiveRunIds(entries) {
   const duplicate = entries.find((entry, index) => entry.runId
     && entries.slice(0, index).some(previous => previous.runId === entry.runId));
@@ -105,6 +108,30 @@ export function validateArchiveRunIds(entries) {
   return entries;
 }
 
+function readArchiveJson(path) {
+  try { return JSON.parse(readFileSync(path, 'utf8')); } catch { return null; }
+}
+
+/** Load valid archived findings and retain a reason for each rejected run. */
+function archivedResults(entries, runsDir) {
+  const results = {};
+  const reasons = [];
+  for (const entry of entries) {
+    if (typeof entry.runId !== 'string' || !RUN_ID.test(entry.runId)) {
+      reasons.push({ key: caseKey(entry), reason: 'unsafe or missing runId' });
+      continue;
+    }
+    const dir = join(runsDir, entry.runId);
+    const evidence = normalizeArchivedEvidence(entry,
+      readArchiveJson(join(dir, 'run.json')),
+      readArchiveJson(join(dir, 'worktree.json')),
+      readArchiveJson(join(dir, 'findings.json')));
+    if (evidence.reason) reasons.push({ key: evidence.key, reason: evidence.reason });
+    else results[evidence.key] = evidence.findings;
+  }
+  return { results, reasons };
+}
+
 export function score(manifest, results) {
   const rows = validateManifest(manifest).map((e) => {
     const key = caseKey(e);
@@ -147,12 +174,24 @@ export function score(manifest, results) {
 
 function main(argv) {
   const flag = (n) => { const i = argv.indexOf('--' + n); return i === -1 ? null : argv[i + 1]; };
-  if (!flag('manifest') || !flag('results')) {
-    console.error('usage: eval-runner.mjs --manifest <manifest.json> --results <results.json> [--json]');
+  const results = flag('results');
+  const archiveIndex = argv.indexOf('--archive');
+  const archive = archiveIndex === -1 ? null : argv[archiveIndex + 1];
+  const resultsIndex = argv.indexOf('--results');
+  if (!flag('manifest') || (archiveIndex !== -1 && (!archive || archive.startsWith('--')))
+      || (resultsIndex !== -1 && (!results || results.startsWith('--')))
+      || Boolean(results) === Boolean(archive)) {
+    console.error('usage: eval-runner.mjs --manifest <manifest.json> (--results <results.json> | --archive <runs-dir>) [--json]');
     process.exit(2);
   }
-  const out = score(JSON.parse(readFileSync(flag('manifest'), 'utf8')), JSON.parse(readFileSync(flag('results'), 'utf8')));
+  const manifest = JSON.parse(readFileSync(flag('manifest'), 'utf8'));
+  const source = archive
+    ? archivedResults(validateArchiveRunIds(validateManifest(manifest)), archive)
+    : { results: JSON.parse(readFileSync(results, 'utf8')), reasons: null };
+  const out = score(manifest, source.results);
+  if (source.reasons) out.unscoredReasons = source.reasons;
   if (argv.includes('--json')) { console.log(JSON.stringify(out)); return; }
+  for (const { key, reason } of source.reasons || []) console.error(`unscored ${key}: ${reason}`);
   const pct = (x) => (x === null ? 'n/a' : `${Math.round(x * 100)}%`);
   if (out.buggyRuns === undefined) {
     console.log(`recall ${pct(out.recall)} (${out.buggyScored} buggy scored), false positives ${out.falsePositives} (${out.cleanScored} clean scored), unscored ${out.unscored.length}`);

package/adapters/claude/olko-github-pr/skills/lekker-review/scripts/evidence-bundle.mjs

@@ -0,0 +1,39 @@
+#!/usr/bin/env node
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { collectGitEvidence } from './git-evidence.mjs';
+import { validateLintReceipt } from './validate-lint-receipt.mjs';
+
+const record = value => value && typeof value === 'object' && !Array.isArray(value);
+const unavailableLint = reason => ({ captureStatus: 'unavailable', reason });
+const unavailableBundle = reason => ({ schema: 1,
+  git: { schema: 1, status: 'unavailable', reason }, lint: unavailableLint(reason) });
+
+export function collectEvidence(worktreeMetadata) {
+  if (!record(worktreeMetadata)) return unavailableBundle('worktree metadata is missing or malformed');
+  const git = collectGitEvidence({ worktreePath: worktreeMetadata.worktreePath,
+    mergeBase: worktreeMetadata.mergeBase, headSha: worktreeMetadata.headSha });
+  if (git.status !== 'available') return { schema: 1, git, lint: unavailableLint(`Git evidence unavailable: ${git.reason}`) };
+  if (typeof worktreeMetadata.eslintJson !== 'string' || !worktreeMetadata.eslintJson) return { schema: 1, git, lint: unavailableLint('lint report path unavailable') };
+  if (typeof worktreeMetadata.eslintProvenance !== 'string' || !worktreeMetadata.eslintProvenance) return { schema: 1, git, lint: unavailableLint('lint provenance path unavailable') };
+  let reportBytes, receipt;
+  try { reportBytes = readFileSync(worktreeMetadata.eslintJson); } catch { return { schema: 1, git, lint: unavailableLint('lint report could not be read') }; }
+  try { receipt = JSON.parse(readFileSync(worktreeMetadata.eslintProvenance, 'utf8')); } catch { return { schema: 1, git, lint: unavailableLint('lint provenance is missing or malformed') }; }
+  const provenance = validateLintReceipt(receipt, { baseSha: git.provenance.baseSha,
+    headSha: git.provenance.headSha, trackedClean: git.provenance.trackedCleanBefore && git.provenance.trackedCleanAfter }, reportBytes);
+  if (provenance.status !== 'available') return { schema: 1, git, lint: unavailableLint(provenance.reason) };
+  let report;
+  try { report = JSON.parse(reportBytes.toString('utf8')); } catch { return { schema: 1, git, lint: unavailableLint('lint report is malformed JSON') }; }
+  if (!Array.isArray(report)) return { schema: 1, git, lint: unavailableLint('lint report is not a JSON array') };
+  return { schema: 1, git, lint: { captureStatus: 'available', exitCode: provenance.exitCode,
+    reportSha256: provenance.reportSha256, report } };
+}
+
+function main(argv) {
+  const i = argv.indexOf('--worktree'), path = i < 0 ? null : argv[i + 1];
+  if (!path || path.startsWith('--')) { console.error('usage: evidence-bundle.mjs --worktree <worktree.json>'); process.exitCode = 2; return; }
+  try { console.log(JSON.stringify(collectEvidence(JSON.parse(readFileSync(path, 'utf8'))))); }
+  catch { console.log(JSON.stringify(unavailableBundle('worktree metadata could not be read'))); process.exitCode = 2; }
+}
+
+if (process.argv[1] === fileURLToPath(import.meta.url)) main(process.argv.slice(2));

package/adapters/claude/olko-github-pr/skills/lekker-review/scripts/git-evidence.mjs

@@ -0,0 +1,39 @@
+import { createHash } from 'node:crypto';
+import { execFileSync } from 'node:child_process';
+import { TextDecoder } from 'node:util';
+import { riskPaths } from './risk-paths.mjs';
+
+const FULL_SHA = /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/i;
+const DIFF_FLAGS = ['--no-ext-diff', '--no-textconv', '--no-color', '--binary', '--no-renames', '--src-prefix=a/', '--dst-prefix=b/', '--full-index', '--unified=3', '--inter-hunk-context=0', '--diff-algorithm=myers', '--indent-heuristic', '--no-relative', '--ignore-submodules=none', '--submodule=short', '-O/dev/null'];
+const unavailable = reason => ({ schema: 1, status: 'unavailable', reason });
+const git = (cwd, args) => execFileSync('git', ['--no-replace-objects', '-c', 'core.quotePath=true', '-c', 'diff.suppressBlankEmpty=false', '-C', cwd, ...args], { stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: 64 * 1024 * 1024, env: Object.fromEntries(Object.entries(process.env).filter(([key]) => !key.startsWith('GIT_'))) });
+const fullSha = value => typeof value === 'string' && FULL_SHA.test(value);
+const headOf = cwd => git(cwd, ['rev-parse', '--verify', 'HEAD^{commit}']).toString('ascii').trim().toLowerCase();
+const trackedStatus = cwd => git(cwd, ['status', '--porcelain', '--untracked-files=no', '--ignore-submodules=none']);
+const flaggedIndex = cwd => git(cwd, ['ls-files', '-v', '-z']).toString().split('\0').some(row => /^[a-z] |^S /.test(row));
+
+export function collectGitEvidence({ worktreePath, mergeBase, headSha } = {}) {
+  if (typeof worktreePath !== 'string' || !worktreePath || !fullSha(mergeBase) || !fullSha(headSha)) return unavailable('worktree path or full commit SHA is invalid');
+  try {
+    const decoder = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true });
+    const baseSha = git(worktreePath, ['rev-parse', '--verify', `${mergeBase}^{commit}`]).toString('ascii').trim().toLowerCase();
+    if (baseSha !== mergeBase.toLowerCase()) return unavailable('merge base does not resolve to the pinned commit');
+    const headBefore = headOf(worktreePath);
+    if (headBefore !== headSha.toLowerCase()) return unavailable('worktree HEAD does not match pinned head');
+    if (flaggedIndex(worktreePath)) return unavailable('tracked index has assume-unchanged or skip-worktree entries before collection');
+    if (trackedStatus(worktreePath).length) return unavailable('tracked worktree is dirty before collection');
+    const rawDiff = git(worktreePath, ['diff', ...DIFF_FLAGS, baseSha, headBefore, '--']);
+    const rawPaths = git(worktreePath, ['diff', '--name-only', '-z', ...DIFF_FLAGS, baseSha, headBefore, '--']);
+    const headAfter = headOf(worktreePath);
+    if (headAfter !== headBefore) return unavailable('worktree HEAD changed during collection');
+    if (flaggedIndex(worktreePath)) return unavailable('tracked index gained assume-unchanged or skip-worktree entries during collection');
+    if (trackedStatus(worktreePath).length) return unavailable('tracked worktree became dirty during collection');
+    const changedPaths = rawPaths.toString('latin1').split('\0').filter(Boolean)
+      .map(path => decoder.decode(Buffer.from(path, 'latin1'))).sort();
+    const text = decoder.decode(rawDiff);
+    return { schema: 1, status: 'available', provenance: { baseSha, headSha: headAfter, trackedCleanBefore: true, trackedCleanAfter: true },
+      changedPaths, diff: { sha256: createHash('sha256').update(rawDiff).digest('hex'), text }, risk: riskPaths(changedPaths, text) };
+  } catch (error) {
+    return unavailable(error instanceof TypeError ? 'git evidence is not valid UTF-8' : 'git evidence command failed');
+  }
+}

package/adapters/claude/olko-github-pr/skills/lekker-review/scripts/native-completion.mjs

@@ -0,0 +1,39 @@
+import { createHash } from 'node:crypto';
+
+const DIMENSIONS = {
+  deps: ['deps'],
+  scan: ['triage-quality', 'triage-logic', 'project-rules'],
+  medium: ['quality', 'implementation', 'simplification', 'conventions', 'test-quality', 'project-rules'],
+  deep: ['quality', 'implementation', 'simplification', 'conventions', 'test-quality', 'project-rules'],
+};
+const SHA = /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/i;
+const HASH = /^[a-f0-9]{64}$/i;
+const record = value => value && typeof value === 'object' && !Array.isArray(value);
+const count = value => Number.isSafeInteger(value) && value >= 0;
+
+/** Validate a native completion receipt against run policy and exact findings bytes. */
+export function validateNativeCompletion(receipt, expected, findingsBytes) {
+  const unavailable = reason => ({ available: false, reason });
+  if (!record(expected) || !record(expected.eligible) || !record(receipt)) return unavailable('receipt or expected inputs are malformed');
+  if (!['deps', 'scan', 'medium', 'deep'].includes(expected.depth) || typeof expected.worktreeAvailable !== 'boolean'
+      || !count(expected.eligible.verify) || !count(expected.eligible.prove)) return unavailable('expected policy inputs are malformed');
+  if (typeof expected.runId !== 'string' || !expected.runId || typeof expected.headSha !== 'string' || !SHA.test(expected.headSha)) return unavailable('expected identity is malformed');
+  if (!(findingsBytes instanceof Uint8Array)) return unavailable('findings bytes are unavailable');
+  if (receipt.schema !== 1 || receipt.engine !== 'codex' || receipt.status !== 'complete') return unavailable('native completion is not complete');
+  if (receipt.runId !== expected.runId || receipt.depth !== expected.depth) return unavailable('run identity or depth mismatch');
+  if (typeof receipt.headSha !== 'string' || !SHA.test(receipt.headSha) || receipt.headSha.toLowerCase() !== expected.headSha.toLowerCase()) return unavailable('head SHA mismatch');
+  if (typeof receipt.findingsSha256 !== 'string' || !HASH.test(receipt.findingsSha256)
+      || createHash('sha256').update(findingsBytes).digest('hex') !== receipt.findingsSha256.toLowerCase()) return unavailable('findings hash mismatch');
+  const required = DIMENSIONS[expected.depth];
+  if (!Array.isArray(receipt.dimensions) || receipt.dimensions.length !== required.length) return unavailable('required review dimensions are missing or duplicated');
+  const dimensions = Array.from(receipt.dimensions);
+  if (dimensions.some(d => !record(d) || !required.includes(d.name) || d.status !== 'completed')) return unavailable('review dimensions are missing, unknown, or incomplete');
+  if (new Set(dimensions.map(d => d.name)).size !== required.length) return unavailable('review dimensions are duplicated');
+  const verify = expected.depth === 'deps' ? 0 : expected.eligible.verify;
+  const prove = ['medium', 'deep'].includes(expected.depth) && expected.worktreeAvailable ? Math.min(5, expected.eligible.prove) : 0;
+  const validStage = (stage, scheduled) => record(stage) && count(stage.scheduled) && count(stage.completed)
+    && count(stage.failed) && stage.scheduled === scheduled && stage.completed === scheduled && stage.failed === 0;
+  if (!record(receipt.stages) || !validStage(receipt.stages.verify, verify) || !validStage(receipt.stages.prove, prove)) return unavailable('verification or proof stage accounting is incomplete');
+  if (receipt.stages.critic !== (expected.depth === 'deep' ? 'completed' : 'not_required')) return unavailable('critic stage status does not match depth');
+  return { available: true, reason: null };
+}

package/adapters/claude/olko-github-pr/skills/lekker-review/scripts/revmux-adapter.mjs

@@ -5,6 +5,7 @@
 import { readFileSync } from 'node:fs'
 import { dirname, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
+import { bugClassOf, extractBadCode, mapSeverity } from './revmux-normalization.mjs'
 
 const args = process.argv.slice(2)
 const reportPath = args[0]
@@ -97,32 +98,6 @@ function extractRule(title) {
   return m && HARD_RULES.has(m[1]) ? m[1] : undefined
 }
 
-// revmux reports one location per finding and no class, so the class is derived
-// from the rule tag or title and no other instances are claimed.
-function bugClassOf(rule, title) {
-  const words = String(rule || title || '').toLowerCase().match(/[a-z0-9]+/g) || []
-  return words.slice(0, 6).join('-') || 'unclassified'
-}
-
-function mapSeverity(f) {
-  if (f.severity === 'critical') return 'critical'
-  if (f.severity === 'major') return 'important'
-  if (f.severity === 'minor') {
-    return (f.lenses || []).includes('lekker-conventions') ? 'idiomatic' : 'observation'
-  }
-  return 'observation'
-}
-
-// Pull an inline code snippet out of the body so hardRuleCorroborated has
-// something to check against; revmux findings carry no separate badCode field.
-function extractBadCode(body) {
-  const text = String(body || '')
-  const backtick = /`([^`]+)`/.exec(text)
-  if (backtick) return backtick[1]
-  const dashCode = /--\s*(.+)$/.exec(text.split('\n')[0])
-  return dashCode ? dashCode[1] : ''
-}
-
 const findings = []
 let droppedCount = 0
 let hardRuleCount = 0

package/adapters/claude/olko-github-pr/skills/lekker-review/scripts/revmux-normalization.mjs

@@ -0,0 +1,27 @@
+// revmux reports one location per finding and no class, so the class is derived
+// from the rule tag or title and no other instances are claimed.
+function bugClassOf(rule, title) {
+  const words = String(rule || title || '').toLowerCase().match(/[a-z0-9]+/g) || []
+  return words.slice(0, 6).join('-') || 'unclassified'
+}
+
+function mapSeverity(f) {
+  if (f.severity === 'critical') return 'critical'
+  if (f.severity === 'major') return 'important'
+  if (f.severity === 'minor') {
+    return (f.lenses || []).includes('lekker-conventions') ? 'idiomatic' : 'observation'
+  }
+  return 'observation'
+}
+
+// Pull an inline code snippet out of the body so hardRuleCorroborated has
+// something to check against; revmux findings carry no separate badCode field.
+function extractBadCode(body) {
+  const text = String(body || '')
+  const backtick = /`([^`]+)`/.exec(text)
+  if (backtick) return backtick[1]
+  const dashCode = /--\s*(.+)$/.exec(text.split('\n')[0])
+  return dashCode ? dashCode[1] : ''
+}
+
+export { bugClassOf, extractBadCode, mapSeverity }

package/adapters/claude/olko-github-pr/skills/lekker-review/scripts/run-log.mjs

@@ -27,7 +27,7 @@
 // `finish` may be called more than once for one run (after the review, again
 // after fix mode); every call appends a fresh row and the newest one wins.
 
-import { readFileSync, writeFileSync, appendFileSync, existsSync, mkdirSync, copyFileSync, readdirSync, statSync, rmSync } from 'node:fs';
+import { readFileSync, writeFileSync, appendFileSync, existsSync, mkdirSync, mkdtempSync, copyFileSync, readdirSync, statSync, rmSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { basename, join } from 'node:path';
 
@@ -152,9 +152,10 @@ if (cmd === 'start') {
   const target = flag('target');
   if (!repo || !target) fail('start needs --repo and --target');
   const startedAt = new Date().toISOString();
-  const runId = `${startedAt.replace(/[-:]/g, '').slice(0, 15)}-${slug(repo.split('/').pop())}-${slug(target)}`;
-  const dir = runDir(runId);
-  mkdirSync(dir, { recursive: true });
+  const prefix = `${startedAt.replace(/[-:]/g, '').slice(0, 15)}-${slug(repo.split('/').pop())}-${slug(target)}-`.slice(0, 249);
+  mkdirSync(RUNS_DIR, { recursive: true });
+  const dir = mkdtempSync(join(RUNS_DIR, prefix));
+  const runId = basename(dir);
   const meta = {
     schema: 1, runId, startedAt, repo, target,
     mode: flag('mode', 'pr'), depth: flag('depth'), engine: flag('engine', 'workflow'),

package/adapters/claude/olko-github-pr/skills/lekker-review/scripts/setup-worktree.sh

@@ -414,7 +414,9 @@ ESLINT_SCOPE_FILE="/tmp/lekker-eslint-scope-$$.txt"
 # temp files): lint-findings.mjs turns it into botPredicted findings, so the
 # review can fix what the bot reviewers would have charged for. Exported by
 # path as eslintJson.
-ESLINT_JSON_FILE="$(dirname "$OUT_JSON")/eslint-report.json"
+ESLINT_ARTIFACT_DIR="$(mktemp -d "$(dirname "$OUT_JSON")/eslint.XXXXXX")"
+ESLINT_JSON_FILE="$ESLINT_ARTIFACT_DIR/eslint-report.json"
+ESLINT_PROVENANCE_FILE="$ESLINT_JSON_FILE.provenance.json"
 printf '' > "$TSC_TAIL_FILE"
 printf '' > "$TSC_CHANGED_FILE"
 printf '0' > "$TSC_COUNT_FILE"
@@ -422,6 +424,37 @@ printf '' > "$ESLINT_TAIL_FILE"
 printf 'skipped' > "$ESLINT_SCOPE_FILE"
 printf '' > "$ESLINT_JSON_FILE"
 
+write_eslint_provenance() {
+    node - "$ESLINT_JSON_FILE" "$ESLINT_PROVENANCE_FILE" "$MERGE_BASE_VAL" "$@" <<'NODE' || rm -f "$ESLINT_PROVENANCE_FILE"
+const { createHash } = require('node:crypto')
+const fs = require('node:fs')
+const [reportPath, receiptPath, baseSha, headBefore, headAfter, cleanBefore, cleanAfter, rawExit] = process.argv.slice(2)
+const fullSha = value => /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/i.test(value || '')
+let bytes = null, validReport = false
+try {
+  bytes = fs.readFileSync(reportPath)
+  const report = JSON.parse(bytes.toString('utf8'))
+  validReport = bytes.length > 0 && Array.isArray(report) && report.length > 0
+    && report.every(file => file && typeof file.filePath === 'string' && file.filePath.trim() && Array.isArray(file.messages))
+} catch {}
+const exitCode = rawExit === '' ? null : Number(rawExit)
+const reasons = []
+if (!fullSha(baseSha)) reasons.push('invalid base SHA')
+if (!fullSha(headBefore) || headBefore !== headAfter) reasons.push('HEAD missing or changed during lint')
+if (cleanBefore !== 'true' || cleanAfter !== 'true') reasons.push('tracked worktree was dirty')
+if (exitCode !== 0 && exitCode !== 1) reasons.push('ESLint did not complete with a result')
+if (!validReport) reasons.push('ESLint report missing or malformed')
+fs.writeFileSync(receiptPath, JSON.stringify({
+  schema: 1, status: reasons.length ? 'unavailable' : 'available',
+  ...(reasons.length ? { reason: reasons.join('; ') } : {}),
+  baseSha: baseSha === 'null' ? null : baseSha,
+  headShaBefore: headBefore || null, headShaAfter: headAfter || null,
+  trackedCleanBefore: cleanBefore === 'true', trackedCleanAfter: cleanAfter === 'true',
+  exitCode, reportSha256: bytes ? createHash('sha256').update(bytes).digest('hex') : null,
+}, null, 2) + '\n')
+NODE
+}
+
 # Render a stylish-style tail from the JSON report. An empty or unparseable
 # report (eslint crashed, bad config) keeps whatever eslint wrote on stderr
 # instead of rendering "0 errors" from nothing.
@@ -473,7 +506,7 @@ run_tsc() {
 }
 
 run_eslint() {
-    local has_config
+    local has_config head_before='' head_after='' clean_before=false clean_after=false lint_exit='' tracked_state
     has_config=false
     if [[ "$NM_LINKED" == "true" ]]; then
         (cd "$WORKTREE_PATH" && compgen -G '.eslintrc*' >/dev/null 2>&1) && has_config=true
@@ -486,8 +519,17 @@ run_eslint() {
                     # One run, JSON formatter: the machine-readable report feeds
                     # lint-findings.mjs and the human tail is rendered from the
                     # same report, so the two can never disagree.
-                    (cd "$WORKTREE_PATH" && npx eslint --max-warnings=0 -f json -o "$ESLINT_JSON_FILE" "${ESLINT_TARGETS[@]}" 2> "$ESLINT_TAIL_FILE") || true
-                    render_eslint_tail
+                    head_before="$(git -C "$WORKTREE_PATH" rev-parse HEAD 2>/dev/null || true)"
+                    if tracked_state="$(git -C "$WORKTREE_PATH" status --porcelain=v1 --untracked-files=no 2>/dev/null)"; then
+                        [[ -z "$tracked_state" ]] && clean_before=true
+                    fi
+                    lint_exit=0
+                    (cd "$WORKTREE_PATH" && npx eslint --max-warnings=0 -f json -o "$ESLINT_JSON_FILE" "${ESLINT_TARGETS[@]}" 2> "$ESLINT_TAIL_FILE") || lint_exit=$?
+                    head_after="$(git -C "$WORKTREE_PATH" rev-parse HEAD 2>/dev/null || true)"
+                    if tracked_state="$(git -C "$WORKTREE_PATH" status --porcelain=v1 --untracked-files=no 2>/dev/null)"; then
+                        [[ -z "$tracked_state" ]] && clean_after=true
+                    fi
+                    render_eslint_tail || true
                     printf 'changed-files' > "$ESLINT_SCOPE_FILE"
                 else
                     printf 'no-changed-lintable-files\n' > "$ESLINT_TAIL_FILE"
@@ -508,6 +550,7 @@ run_eslint() {
         printf 'skipped\n' > "$ESLINT_TAIL_FILE"
         printf 'skipped' > "$ESLINT_SCOPE_FILE"
     fi
+    write_eslint_provenance "$head_before" "$head_after" "$clean_before" "$clean_after" "$lint_exit"
 }
 
 run_tsc &
@@ -582,6 +625,7 @@ python3 - \
     "$MERGE_BASE_VAL" \
     "$DEPS_INSTALL_FILE" \
     "$ESLINT_JSON_FILE" \
+    "$ESLINT_PROVENANCE_FILE" \
     "$TEST_RUNNER_JSON" \
     "$OUT_JSON" \
     "$BASE_RULES_FILE" \
@@ -592,8 +636,8 @@ import json, sys, os
  tsc_file, eslint_file, rules_file, delta_file, notes,
  changed_files_file, base_ref_val, eslint_scope_file,
  tsc_changed_file, tsc_count_file, merge_base_val,
- deps_install_file, eslint_json_file, test_runner_json, out_json,
- base_rules_file, base_rules_state) = sys.argv[1:22]
+ deps_install_file, eslint_json_file, eslint_provenance_file, test_runner_json, out_json,
+ base_rules_file, base_rules_state) = sys.argv[1:23]
 
 def parse_runner(raw):
     try:
@@ -665,6 +709,7 @@ data = {
     # no structured report (skipped, no config, crashed, or the repo-wide
     # fallback), so a consumer can tell "no lint report" from "no problems".
     "eslintJson":     eslint_json_file if file_has_content(eslint_json_file) else None,
+    "eslintProvenance": eslint_provenance_file if file_has_content(eslint_provenance_file) else None,
 }
 
 for p in (tsc_file, eslint_file, rules_file, base_rules_file, changed_files_file,

package/adapters/claude/olko-github-pr/skills/lekker-review/scripts/validate-lint-receipt.mjs

@@ -0,0 +1,33 @@
+import { createHash } from 'node:crypto'
+
+const FULL_SHA = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/i
+const HASH = /^[0-9a-f]{64}$/i
+const unavailable = reason => ({ status: 'unavailable', reason })
+
+export function validateLintReceipt(receipt, expected, reportBytes) {
+  if (!receipt || typeof receipt !== 'object' || Array.isArray(receipt)) return unavailable('receipt missing or malformed')
+  if (!expected || typeof expected !== 'object' || Array.isArray(expected)) return unavailable('expected provenance missing')
+  if (!(reportBytes instanceof Uint8Array)) return unavailable('raw lint report bytes unavailable')
+  if (typeof expected.baseSha !== 'string' || !FULL_SHA.test(expected.baseSha)
+      || typeof expected.headSha !== 'string' || !FULL_SHA.test(expected.headSha)) return unavailable('expected base/head must be full SHAs')
+  if (expected.trackedClean !== true) return unavailable('current tracked worktree is not clean')
+  if (receipt.schema !== 1) return unavailable('unsupported receipt schema')
+  if (receipt.status !== 'available') return unavailable(typeof receipt.reason === 'string' ? receipt.reason : 'receipt status is unavailable')
+  if (typeof receipt.baseSha !== 'string' || !FULL_SHA.test(receipt.baseSha)
+      || receipt.baseSha.toLowerCase() !== expected.baseSha.toLowerCase()) return unavailable('base SHA mismatch')
+  if (typeof receipt.headShaBefore !== 'string' || !FULL_SHA.test(receipt.headShaBefore)
+      || typeof receipt.headShaAfter !== 'string' || !FULL_SHA.test(receipt.headShaAfter)
+      || receipt.headShaBefore.toLowerCase() !== receipt.headShaAfter.toLowerCase()
+      || receipt.headShaBefore.toLowerCase() !== expected.headSha.toLowerCase()) return unavailable('head SHA mismatch or drift')
+  if (receipt.trackedCleanBefore !== true || receipt.trackedCleanAfter !== true) return unavailable('captured tracked worktree was not clean')
+  if (receipt.exitCode !== 0 && receipt.exitCode !== 1) return unavailable('invalid ESLint exit code')
+  if (typeof receipt.reportSha256 !== 'string' || !HASH.test(receipt.reportSha256)) return unavailable('report SHA-256 missing or malformed')
+  const reportSha256 = createHash('sha256').update(reportBytes).digest('hex')
+  if (reportSha256 !== receipt.reportSha256.toLowerCase()) return unavailable('lint report hash mismatch')
+  return {
+    status: 'available',
+    baseSha: receipt.baseSha, headSha: receipt.headShaBefore,
+    exitCode: receipt.exitCode, reportSha256,
+    trackedCleanBefore: receipt.trackedCleanBefore, trackedCleanAfter: receipt.trackedCleanAfter,
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@olegkoval/agent-skills",
-  "version": "1.76.0",
+  "version": "1.78.0",
   "private": false,
   "publishConfig": {
     "access": "public"

package/plugins/olko-apple-kit/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-apple-kit",
   "description": "Build and ship Apple platform apps: macOS menubar apps, App Store submissions.",
-  "version": "1.76.0",
+  "version": "1.78.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-creative/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-creative",
   "description": "Creative and personal projects: photo galleries, music players, listings, wiki editing.",
-  "version": "1.76.0",
+  "version": "1.78.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-garmin-kit/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-garmin-kit",
   "description": "Build, test and publish Garmin Connect IQ watch faces.",
-  "version": "1.76.0",
+  "version": "1.78.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-git-tools/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-git-tools",
   "description": "Everyday git and GitHub CLI operations: conventional commits, branch hygiene.",
-  "version": "1.76.0",
+  "version": "1.78.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-github-pr/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-github-pr",
   "description": "Drive GitHub pull requests to merge-ready: review-bot loops, CI fixes, descriptions, dependency triage.",
-  "version": "1.76.0",
+  "version": "1.78.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-github-pr/skills/lekker-review/SKILL.md

@@ -510,9 +510,11 @@ ${SKILL_ROOT}/scripts/setup-worktree.sh \
 On completion, read `worktree.json`. Keys emitted:
 `worktreePath`, `repoRoot`, `headSha`, `headShaShort`, `tscTail`,
 `tscChangedTail`, `tscErrorCount`, `eslintTail`, `eslintScope`, `eslintJson`,
-`changedFiles`, `baseRef`, `mergeBase`, `projectRules`, `deltaFile`, `notes`,
+`eslintProvenance`, `changedFiles`, `baseRef`, `mergeBase`, `projectRules`, `deltaFile`, `notes`,
 `depsInstall`, `testRunner`.
 
+`eslintProvenance` is the provenance-only receipt for `eslintJson` (base/head, tracked-worktree state, exit code, raw report hash).
+
 `testRunner` is `{runner, dirs, reason}` from `scripts/test-runner.mjs`:
 `runner` is `vitest|jest|mocha|node-test` only when its binary is installed
 in the worktree, `dirs` lists `{dir, runner}` pairs for each usable package

package/plugins/olko-github-pr/skills/lekker-review/scripts/codex-usage.mjs

@@ -0,0 +1,69 @@
+#!/usr/bin/env node
+import { createReadStream, readFileSync } from 'node:fs';
+import { createInterface } from 'node:readline';
+import { fileURLToPath } from 'node:url';
+
+const FIELDS = ['input_tokens', 'cached_input_tokens', 'cache_write_input_tokens', 'output_tokens', 'reasoning_output_tokens', 'total_tokens'];
+const record = v => v && typeof v === 'object' && !Array.isArray(v);
+const unavailable = (agentPath, reason) => ({ agentPath, status: 'unavailable', reason });
+
+async function inspectSession(sessionFile, parentThreadId, agentPath) {
+  let sessionId = null, usage = null, complete = false, models = [];
+  try {
+    const input = createReadStream(sessionFile);
+    for await (const line of createInterface({ input, crlfDelay: Infinity })) {
+      if (!line.trim()) continue;
+      let row;
+      try { row = JSON.parse(line); } catch { return unavailable(agentPath, 'malformed JSONL'); }
+      if (row.type === 'session_meta') {
+        const spawn = row.payload?.source?.subagent?.thread_spawn;
+        if (sessionId || typeof row.payload?.id !== 'string' || !row.payload.id) return unavailable(agentPath, 'session metadata missing or duplicated');
+        if (spawn?.parent_thread_id !== parentThreadId || spawn?.agent_path !== agentPath) return unavailable(agentPath, 'parent thread or agent path mismatch');
+        sessionId = row.payload.id;
+      } else if (row.type === 'turn_context' && typeof row.payload?.model === 'string' && row.payload.model && !models.includes(row.payload.model)) {
+        models = [...models, row.payload.model];
+      } else if (row.type === 'event_msg' && row.payload?.type === 'task_started') complete = false;
+      else if (row.type === 'event_msg' && row.payload?.type === 'task_complete') complete = true;
+      else if (row.type === 'event_msg' && row.payload?.type === 'token_count') {
+        const raw = row.payload.info?.total_token_usage;
+        if (!record(raw) || FIELDS.some(k => !Number.isSafeInteger(raw[k]) || raw[k] < 0)) return unavailable(agentPath, 'token counters are malformed');
+        const next = Object.fromEntries(FIELDS.map(k => [k, raw[k]]));
+        if (usage && FIELDS.some(k => next[k] < usage[k])) return unavailable(agentPath, 'token counters decreased');
+        usage = next;
+      }
+    }
+  } catch { return unavailable(agentPath, 'session file could not be read'); }
+  if (!sessionId) return unavailable(agentPath, 'session metadata unavailable');
+  if (!complete) return unavailable(agentPath, 'task completion unavailable');
+  if (!usage) return unavailable(agentPath, 'token counters unavailable');
+  return { agentPath, status: 'available', sessionId, models, usage };
+}
+
+export async function collectUsage(manifest) {
+  if (!record(manifest) || typeof manifest.parentThreadId !== 'string' || !manifest.parentThreadId
+      || !Array.isArray(manifest.agents) || !manifest.agents.length
+      || manifest.agents.some(a => !record(a) || typeof a.agentPath !== 'string' || !a.agentPath || typeof a.sessionFile !== 'string' || !a.sessionFile)) {
+    return { available: false, agents: [], totals: null, reason: 'manifest needs parentThreadId and explicit agentPath/sessionFile entries' };
+  }
+  const paths = manifest.agents.map(a => a.agentPath), files = manifest.agents.map(a => a.sessionFile);
+  if (paths.some((p, i) => paths.indexOf(p) !== i) || files.some((p, i) => files.indexOf(p) !== i)) {
+    return { available: false, agents: [], totals: null, reason: 'manifest repeats an agent path or session file' };
+  }
+  let agents = [];
+  for (const agent of manifest.agents) agents = [...agents, await inspectSession(agent.sessionFile, manifest.parentThreadId, agent.agentPath)];
+  const available = agents.every(a => a.status !== 'unavailable');
+  const totals = available ? Object.fromEntries(FIELDS.map(k => [k, agents.reduce((n, a) => n + a.usage[k], 0)])) : null;
+  const safe = totals && FIELDS.every(k => Number.isSafeInteger(totals[k]));
+  return { available: Boolean(safe), agents, totals: safe ? totals : null, ...(available && !safe ? { reason: 'aggregate token counters exceed safe integer range' } : {}) };
+}
+
+async function main(argv) {
+  const i = argv.indexOf('--manifest'), path = i < 0 ? null : argv[i + 1];
+  if (!path || path.startsWith('--')) { console.error('usage: codex-usage.mjs --manifest <explicit-sessions.json>'); process.exitCode = 2; return; }
+  let result;
+  try { result = await collectUsage(JSON.parse(readFileSync(path, 'utf8'))); }
+  catch { result = { available: false, agents: [], totals: null, reason: 'manifest could not be read' }; process.exitCode = 2; }
+  console.log(JSON.stringify(result));
+}
+
+if (process.argv[1] === fileURLToPath(import.meta.url)) main(process.argv.slice(2));

package/plugins/olko-github-pr/skills/lekker-review/scripts/eval-runner.mjs

@@ -2,7 +2,7 @@
 // Score lekker findings against a manifest of PRs with known outcomes.
 //
 // Usage:
-//   node eval-runner.mjs --manifest evals/manifest.json --results <results.json> [--json]
+//   node eval-runner.mjs --manifest <manifest.json> (--results <results.json> | --archive <runs-dir>) [--json]
 //
 // manifest.json: { prs: [{ repo, pr, expect: "buggy"|"clean", knownBug?: "file:line + description", id?, sha? }] }
 //                The case key is `id` when present, else "<repo>#<pr>@<sha>" when `sha` is
@@ -21,6 +21,7 @@
 // verdict-affecting finding (critical or important) is a false positive.
 
 import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 export const LINE_WINDOW = 10;
@@ -74,6 +75,7 @@ export function validateManifest(manifest) {
   return prs;
 }
 
+/** Normalize archived review evidence, returning findings only when every identity check passes. */
 export function normalizeArchivedEvidence(entry, run, worktree, document) {
   const key = caseKey(entry);
   const unscored = (reason) => ({ key, reason });
@@ -98,6 +100,7 @@ export function normalizeArchivedEvidence(entry, run, worktree, document) {
 }
 
 // Validate archive references before reading any run directories.
+/** Reject duplicate archive run IDs before archive paths are read. */
 export function validateArchiveRunIds(entries) {
   const duplicate = entries.find((entry, index) => entry.runId
     && entries.slice(0, index).some(previous => previous.runId === entry.runId));
@@ -105,6 +108,30 @@ export function validateArchiveRunIds(entries) {
   return entries;
 }
 
+function readArchiveJson(path) {
+  try { return JSON.parse(readFileSync(path, 'utf8')); } catch { return null; }
+}
+
+/** Load valid archived findings and retain a reason for each rejected run. */
+function archivedResults(entries, runsDir) {
+  const results = {};
+  const reasons = [];
+  for (const entry of entries) {
+    if (typeof entry.runId !== 'string' || !RUN_ID.test(entry.runId)) {
+      reasons.push({ key: caseKey(entry), reason: 'unsafe or missing runId' });
+      continue;
+    }
+    const dir = join(runsDir, entry.runId);
+    const evidence = normalizeArchivedEvidence(entry,
+      readArchiveJson(join(dir, 'run.json')),
+      readArchiveJson(join(dir, 'worktree.json')),
+      readArchiveJson(join(dir, 'findings.json')));
+    if (evidence.reason) reasons.push({ key: evidence.key, reason: evidence.reason });
+    else results[evidence.key] = evidence.findings;
+  }
+  return { results, reasons };
+}
+
 export function score(manifest, results) {
   const rows = validateManifest(manifest).map((e) => {
     const key = caseKey(e);
@@ -147,12 +174,24 @@ export function score(manifest, results) {
 
 function main(argv) {
   const flag = (n) => { const i = argv.indexOf('--' + n); return i === -1 ? null : argv[i + 1]; };
-  if (!flag('manifest') || !flag('results')) {
-    console.error('usage: eval-runner.mjs --manifest <manifest.json> --results <results.json> [--json]');
+  const results = flag('results');
+  const archiveIndex = argv.indexOf('--archive');
+  const archive = archiveIndex === -1 ? null : argv[archiveIndex + 1];
+  const resultsIndex = argv.indexOf('--results');
+  if (!flag('manifest') || (archiveIndex !== -1 && (!archive || archive.startsWith('--')))
+      || (resultsIndex !== -1 && (!results || results.startsWith('--')))
+      || Boolean(results) === Boolean(archive)) {
+    console.error('usage: eval-runner.mjs --manifest <manifest.json> (--results <results.json> | --archive <runs-dir>) [--json]');
     process.exit(2);
   }
-  const out = score(JSON.parse(readFileSync(flag('manifest'), 'utf8')), JSON.parse(readFileSync(flag('results'), 'utf8')));
+  const manifest = JSON.parse(readFileSync(flag('manifest'), 'utf8'));
+  const source = archive
+    ? archivedResults(validateArchiveRunIds(validateManifest(manifest)), archive)
+    : { results: JSON.parse(readFileSync(results, 'utf8')), reasons: null };
+  const out = score(manifest, source.results);
+  if (source.reasons) out.unscoredReasons = source.reasons;
   if (argv.includes('--json')) { console.log(JSON.stringify(out)); return; }
+  for (const { key, reason } of source.reasons || []) console.error(`unscored ${key}: ${reason}`);
   const pct = (x) => (x === null ? 'n/a' : `${Math.round(x * 100)}%`);
   if (out.buggyRuns === undefined) {
     console.log(`recall ${pct(out.recall)} (${out.buggyScored} buggy scored), false positives ${out.falsePositives} (${out.cleanScored} clean scored), unscored ${out.unscored.length}`);

package/plugins/olko-github-pr/skills/lekker-review/scripts/evidence-bundle.mjs

@@ -0,0 +1,39 @@
+#!/usr/bin/env node
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { collectGitEvidence } from './git-evidence.mjs';
+import { validateLintReceipt } from './validate-lint-receipt.mjs';
+
+const record = value => value && typeof value === 'object' && !Array.isArray(value);
+const unavailableLint = reason => ({ captureStatus: 'unavailable', reason });
+const unavailableBundle = reason => ({ schema: 1,
+  git: { schema: 1, status: 'unavailable', reason }, lint: unavailableLint(reason) });
+
+export function collectEvidence(worktreeMetadata) {
+  if (!record(worktreeMetadata)) return unavailableBundle('worktree metadata is missing or malformed');
+  const git = collectGitEvidence({ worktreePath: worktreeMetadata.worktreePath,
+    mergeBase: worktreeMetadata.mergeBase, headSha: worktreeMetadata.headSha });
+  if (git.status !== 'available') return { schema: 1, git, lint: unavailableLint(`Git evidence unavailable: ${git.reason}`) };
+  if (typeof worktreeMetadata.eslintJson !== 'string' || !worktreeMetadata.eslintJson) return { schema: 1, git, lint: unavailableLint('lint report path unavailable') };
+  if (typeof worktreeMetadata.eslintProvenance !== 'string' || !worktreeMetadata.eslintProvenance) return { schema: 1, git, lint: unavailableLint('lint provenance path unavailable') };
+  let reportBytes, receipt;
+  try { reportBytes = readFileSync(worktreeMetadata.eslintJson); } catch { return { schema: 1, git, lint: unavailableLint('lint report could not be read') }; }
+  try { receipt = JSON.parse(readFileSync(worktreeMetadata.eslintProvenance, 'utf8')); } catch { return { schema: 1, git, lint: unavailableLint('lint provenance is missing or malformed') }; }
+  const provenance = validateLintReceipt(receipt, { baseSha: git.provenance.baseSha,
+    headSha: git.provenance.headSha, trackedClean: git.provenance.trackedCleanBefore && git.provenance.trackedCleanAfter }, reportBytes);
+  if (provenance.status !== 'available') return { schema: 1, git, lint: unavailableLint(provenance.reason) };
+  let report;
+  try { report = JSON.parse(reportBytes.toString('utf8')); } catch { return { schema: 1, git, lint: unavailableLint('lint report is malformed JSON') }; }
+  if (!Array.isArray(report)) return { schema: 1, git, lint: unavailableLint('lint report is not a JSON array') };
+  return { schema: 1, git, lint: { captureStatus: 'available', exitCode: provenance.exitCode,
+    reportSha256: provenance.reportSha256, report } };
+}
+
+function main(argv) {
+  const i = argv.indexOf('--worktree'), path = i < 0 ? null : argv[i + 1];
+  if (!path || path.startsWith('--')) { console.error('usage: evidence-bundle.mjs --worktree <worktree.json>'); process.exitCode = 2; return; }
+  try { console.log(JSON.stringify(collectEvidence(JSON.parse(readFileSync(path, 'utf8'))))); }
+  catch { console.log(JSON.stringify(unavailableBundle('worktree metadata could not be read'))); process.exitCode = 2; }
+}
+
+if (process.argv[1] === fileURLToPath(import.meta.url)) main(process.argv.slice(2));

package/plugins/olko-github-pr/skills/lekker-review/scripts/git-evidence.mjs

@@ -0,0 +1,39 @@
+import { createHash } from 'node:crypto';
+import { execFileSync } from 'node:child_process';
+import { TextDecoder } from 'node:util';
+import { riskPaths } from './risk-paths.mjs';
+
+const FULL_SHA = /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/i;
+const DIFF_FLAGS = ['--no-ext-diff', '--no-textconv', '--no-color', '--binary', '--no-renames', '--src-prefix=a/', '--dst-prefix=b/', '--full-index', '--unified=3', '--inter-hunk-context=0', '--diff-algorithm=myers', '--indent-heuristic', '--no-relative', '--ignore-submodules=none', '--submodule=short', '-O/dev/null'];
+const unavailable = reason => ({ schema: 1, status: 'unavailable', reason });
+const git = (cwd, args) => execFileSync('git', ['--no-replace-objects', '-c', 'core.quotePath=true', '-c', 'diff.suppressBlankEmpty=false', '-C', cwd, ...args], { stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: 64 * 1024 * 1024, env: Object.fromEntries(Object.entries(process.env).filter(([key]) => !key.startsWith('GIT_'))) });
+const fullSha = value => typeof value === 'string' && FULL_SHA.test(value);
+const headOf = cwd => git(cwd, ['rev-parse', '--verify', 'HEAD^{commit}']).toString('ascii').trim().toLowerCase();
+const trackedStatus = cwd => git(cwd, ['status', '--porcelain', '--untracked-files=no', '--ignore-submodules=none']);
+const flaggedIndex = cwd => git(cwd, ['ls-files', '-v', '-z']).toString().split('\0').some(row => /^[a-z] |^S /.test(row));
+
+export function collectGitEvidence({ worktreePath, mergeBase, headSha } = {}) {
+  if (typeof worktreePath !== 'string' || !worktreePath || !fullSha(mergeBase) || !fullSha(headSha)) return unavailable('worktree path or full commit SHA is invalid');
+  try {
+    const decoder = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true });
+    const baseSha = git(worktreePath, ['rev-parse', '--verify', `${mergeBase}^{commit}`]).toString('ascii').trim().toLowerCase();
+    if (baseSha !== mergeBase.toLowerCase()) return unavailable('merge base does not resolve to the pinned commit');
+    const headBefore = headOf(worktreePath);
+    if (headBefore !== headSha.toLowerCase()) return unavailable('worktree HEAD does not match pinned head');
+    if (flaggedIndex(worktreePath)) return unavailable('tracked index has assume-unchanged or skip-worktree entries before collection');
+    if (trackedStatus(worktreePath).length) return unavailable('tracked worktree is dirty before collection');
+    const rawDiff = git(worktreePath, ['diff', ...DIFF_FLAGS, baseSha, headBefore, '--']);
+    const rawPaths = git(worktreePath, ['diff', '--name-only', '-z', ...DIFF_FLAGS, baseSha, headBefore, '--']);
+    const headAfter = headOf(worktreePath);
+    if (headAfter !== headBefore) return unavailable('worktree HEAD changed during collection');
+    if (flaggedIndex(worktreePath)) return unavailable('tracked index gained assume-unchanged or skip-worktree entries during collection');
+    if (trackedStatus(worktreePath).length) return unavailable('tracked worktree became dirty during collection');
+    const changedPaths = rawPaths.toString('latin1').split('\0').filter(Boolean)
+      .map(path => decoder.decode(Buffer.from(path, 'latin1'))).sort();
+    const text = decoder.decode(rawDiff);
+    return { schema: 1, status: 'available', provenance: { baseSha, headSha: headAfter, trackedCleanBefore: true, trackedCleanAfter: true },
+      changedPaths, diff: { sha256: createHash('sha256').update(rawDiff).digest('hex'), text }, risk: riskPaths(changedPaths, text) };
+  } catch (error) {
+    return unavailable(error instanceof TypeError ? 'git evidence is not valid UTF-8' : 'git evidence command failed');
+  }
+}

package/plugins/olko-github-pr/skills/lekker-review/scripts/native-completion.mjs

@@ -0,0 +1,39 @@
+import { createHash } from 'node:crypto';
+
+const DIMENSIONS = {
+  deps: ['deps'],
+  scan: ['triage-quality', 'triage-logic', 'project-rules'],
+  medium: ['quality', 'implementation', 'simplification', 'conventions', 'test-quality', 'project-rules'],
+  deep: ['quality', 'implementation', 'simplification', 'conventions', 'test-quality', 'project-rules'],
+};
+const SHA = /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/i;
+const HASH = /^[a-f0-9]{64}$/i;
+const record = value => value && typeof value === 'object' && !Array.isArray(value);
+const count = value => Number.isSafeInteger(value) && value >= 0;
+
+/** Validate a native completion receipt against run policy and exact findings bytes. */
+export function validateNativeCompletion(receipt, expected, findingsBytes) {
+  const unavailable = reason => ({ available: false, reason });
+  if (!record(expected) || !record(expected.eligible) || !record(receipt)) return unavailable('receipt or expected inputs are malformed');
+  if (!['deps', 'scan', 'medium', 'deep'].includes(expected.depth) || typeof expected.worktreeAvailable !== 'boolean'
+      || !count(expected.eligible.verify) || !count(expected.eligible.prove)) return unavailable('expected policy inputs are malformed');
+  if (typeof expected.runId !== 'string' || !expected.runId || typeof expected.headSha !== 'string' || !SHA.test(expected.headSha)) return unavailable('expected identity is malformed');
+  if (!(findingsBytes instanceof Uint8Array)) return unavailable('findings bytes are unavailable');
+  if (receipt.schema !== 1 || receipt.engine !== 'codex' || receipt.status !== 'complete') return unavailable('native completion is not complete');
+  if (receipt.runId !== expected.runId || receipt.depth !== expected.depth) return unavailable('run identity or depth mismatch');
+  if (typeof receipt.headSha !== 'string' || !SHA.test(receipt.headSha) || receipt.headSha.toLowerCase() !== expected.headSha.toLowerCase()) return unavailable('head SHA mismatch');
+  if (typeof receipt.findingsSha256 !== 'string' || !HASH.test(receipt.findingsSha256)
+      || createHash('sha256').update(findingsBytes).digest('hex') !== receipt.findingsSha256.toLowerCase()) return unavailable('findings hash mismatch');
+  const required = DIMENSIONS[expected.depth];
+  if (!Array.isArray(receipt.dimensions) || receipt.dimensions.length !== required.length) return unavailable('required review dimensions are missing or duplicated');
+  const dimensions = Array.from(receipt.dimensions);
+  if (dimensions.some(d => !record(d) || !required.includes(d.name) || d.status !== 'completed')) return unavailable('review dimensions are missing, unknown, or incomplete');
+  if (new Set(dimensions.map(d => d.name)).size !== required.length) return unavailable('review dimensions are duplicated');
+  const verify = expected.depth === 'deps' ? 0 : expected.eligible.verify;
+  const prove = ['medium', 'deep'].includes(expected.depth) && expected.worktreeAvailable ? Math.min(5, expected.eligible.prove) : 0;
+  const validStage = (stage, scheduled) => record(stage) && count(stage.scheduled) && count(stage.completed)
+    && count(stage.failed) && stage.scheduled === scheduled && stage.completed === scheduled && stage.failed === 0;
+  if (!record(receipt.stages) || !validStage(receipt.stages.verify, verify) || !validStage(receipt.stages.prove, prove)) return unavailable('verification or proof stage accounting is incomplete');
+  if (receipt.stages.critic !== (expected.depth === 'deep' ? 'completed' : 'not_required')) return unavailable('critic stage status does not match depth');
+  return { available: true, reason: null };
+}

package/plugins/olko-github-pr/skills/lekker-review/scripts/revmux-adapter.mjs

@@ -5,6 +5,7 @@
 import { readFileSync } from 'node:fs'
 import { dirname, resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
+import { bugClassOf, extractBadCode, mapSeverity } from './revmux-normalization.mjs'
 
 const args = process.argv.slice(2)
 const reportPath = args[0]
@@ -97,32 +98,6 @@ function extractRule(title) {
   return m && HARD_RULES.has(m[1]) ? m[1] : undefined
 }
 
-// revmux reports one location per finding and no class, so the class is derived
-// from the rule tag or title and no other instances are claimed.
-function bugClassOf(rule, title) {
-  const words = String(rule || title || '').toLowerCase().match(/[a-z0-9]+/g) || []
-  return words.slice(0, 6).join('-') || 'unclassified'
-}
-
-function mapSeverity(f) {
-  if (f.severity === 'critical') return 'critical'
-  if (f.severity === 'major') return 'important'
-  if (f.severity === 'minor') {
-    return (f.lenses || []).includes('lekker-conventions') ? 'idiomatic' : 'observation'
-  }
-  return 'observation'
-}
-
-// Pull an inline code snippet out of the body so hardRuleCorroborated has
-// something to check against; revmux findings carry no separate badCode field.
-function extractBadCode(body) {
-  const text = String(body || '')
-  const backtick = /`([^`]+)`/.exec(text)
-  if (backtick) return backtick[1]
-  const dashCode = /--\s*(.+)$/.exec(text.split('\n')[0])
-  return dashCode ? dashCode[1] : ''
-}
-
 const findings = []
 let droppedCount = 0
 let hardRuleCount = 0

package/plugins/olko-github-pr/skills/lekker-review/scripts/revmux-normalization.mjs

@@ -0,0 +1,27 @@
+// revmux reports one location per finding and no class, so the class is derived
+// from the rule tag or title and no other instances are claimed.
+function bugClassOf(rule, title) {
+  const words = String(rule || title || '').toLowerCase().match(/[a-z0-9]+/g) || []
+  return words.slice(0, 6).join('-') || 'unclassified'
+}
+
+function mapSeverity(f) {
+  if (f.severity === 'critical') return 'critical'
+  if (f.severity === 'major') return 'important'
+  if (f.severity === 'minor') {
+    return (f.lenses || []).includes('lekker-conventions') ? 'idiomatic' : 'observation'
+  }
+  return 'observation'
+}
+
+// Pull an inline code snippet out of the body so hardRuleCorroborated has
+// something to check against; revmux findings carry no separate badCode field.
+function extractBadCode(body) {
+  const text = String(body || '')
+  const backtick = /`([^`]+)`/.exec(text)
+  if (backtick) return backtick[1]
+  const dashCode = /--\s*(.+)$/.exec(text.split('\n')[0])
+  return dashCode ? dashCode[1] : ''
+}
+
+export { bugClassOf, extractBadCode, mapSeverity }

package/plugins/olko-github-pr/skills/lekker-review/scripts/run-log.mjs

@@ -27,7 +27,7 @@
 // `finish` may be called more than once for one run (after the review, again
 // after fix mode); every call appends a fresh row and the newest one wins.
 
-import { readFileSync, writeFileSync, appendFileSync, existsSync, mkdirSync, copyFileSync, readdirSync, statSync, rmSync } from 'node:fs';
+import { readFileSync, writeFileSync, appendFileSync, existsSync, mkdirSync, mkdtempSync, copyFileSync, readdirSync, statSync, rmSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { basename, join } from 'node:path';
 
@@ -152,9 +152,10 @@ if (cmd === 'start') {
   const target = flag('target');
   if (!repo || !target) fail('start needs --repo and --target');
   const startedAt = new Date().toISOString();
-  const runId = `${startedAt.replace(/[-:]/g, '').slice(0, 15)}-${slug(repo.split('/').pop())}-${slug(target)}`;
-  const dir = runDir(runId);
-  mkdirSync(dir, { recursive: true });
+  const prefix = `${startedAt.replace(/[-:]/g, '').slice(0, 15)}-${slug(repo.split('/').pop())}-${slug(target)}-`.slice(0, 249);
+  mkdirSync(RUNS_DIR, { recursive: true });
+  const dir = mkdtempSync(join(RUNS_DIR, prefix));
+  const runId = basename(dir);
   const meta = {
     schema: 1, runId, startedAt, repo, target,
     mode: flag('mode', 'pr'), depth: flag('depth'), engine: flag('engine', 'workflow'),

package/plugins/olko-github-pr/skills/lekker-review/scripts/setup-worktree.sh

@@ -414,7 +414,9 @@ ESLINT_SCOPE_FILE="/tmp/lekker-eslint-scope-$$.txt"
 # temp files): lint-findings.mjs turns it into botPredicted findings, so the
 # review can fix what the bot reviewers would have charged for. Exported by
 # path as eslintJson.
-ESLINT_JSON_FILE="$(dirname "$OUT_JSON")/eslint-report.json"
+ESLINT_ARTIFACT_DIR="$(mktemp -d "$(dirname "$OUT_JSON")/eslint.XXXXXX")"
+ESLINT_JSON_FILE="$ESLINT_ARTIFACT_DIR/eslint-report.json"
+ESLINT_PROVENANCE_FILE="$ESLINT_JSON_FILE.provenance.json"
 printf '' > "$TSC_TAIL_FILE"
 printf '' > "$TSC_CHANGED_FILE"
 printf '0' > "$TSC_COUNT_FILE"
@@ -422,6 +424,37 @@ printf '' > "$ESLINT_TAIL_FILE"
 printf 'skipped' > "$ESLINT_SCOPE_FILE"
 printf '' > "$ESLINT_JSON_FILE"
 
+write_eslint_provenance() {
+    node - "$ESLINT_JSON_FILE" "$ESLINT_PROVENANCE_FILE" "$MERGE_BASE_VAL" "$@" <<'NODE' || rm -f "$ESLINT_PROVENANCE_FILE"
+const { createHash } = require('node:crypto')
+const fs = require('node:fs')
+const [reportPath, receiptPath, baseSha, headBefore, headAfter, cleanBefore, cleanAfter, rawExit] = process.argv.slice(2)
+const fullSha = value => /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/i.test(value || '')
+let bytes = null, validReport = false
+try {
+  bytes = fs.readFileSync(reportPath)
+  const report = JSON.parse(bytes.toString('utf8'))
+  validReport = bytes.length > 0 && Array.isArray(report) && report.length > 0
+    && report.every(file => file && typeof file.filePath === 'string' && file.filePath.trim() && Array.isArray(file.messages))
+} catch {}
+const exitCode = rawExit === '' ? null : Number(rawExit)
+const reasons = []
+if (!fullSha(baseSha)) reasons.push('invalid base SHA')
+if (!fullSha(headBefore) || headBefore !== headAfter) reasons.push('HEAD missing or changed during lint')
+if (cleanBefore !== 'true' || cleanAfter !== 'true') reasons.push('tracked worktree was dirty')
+if (exitCode !== 0 && exitCode !== 1) reasons.push('ESLint did not complete with a result')
+if (!validReport) reasons.push('ESLint report missing or malformed')
+fs.writeFileSync(receiptPath, JSON.stringify({
+  schema: 1, status: reasons.length ? 'unavailable' : 'available',
+  ...(reasons.length ? { reason: reasons.join('; ') } : {}),
+  baseSha: baseSha === 'null' ? null : baseSha,
+  headShaBefore: headBefore || null, headShaAfter: headAfter || null,
+  trackedCleanBefore: cleanBefore === 'true', trackedCleanAfter: cleanAfter === 'true',
+  exitCode, reportSha256: bytes ? createHash('sha256').update(bytes).digest('hex') : null,
+}, null, 2) + '\n')
+NODE
+}
+
 # Render a stylish-style tail from the JSON report. An empty or unparseable
 # report (eslint crashed, bad config) keeps whatever eslint wrote on stderr
 # instead of rendering "0 errors" from nothing.
@@ -473,7 +506,7 @@ run_tsc() {
 }
 
 run_eslint() {
-    local has_config
+    local has_config head_before='' head_after='' clean_before=false clean_after=false lint_exit='' tracked_state
     has_config=false
     if [[ "$NM_LINKED" == "true" ]]; then
         (cd "$WORKTREE_PATH" && compgen -G '.eslintrc*' >/dev/null 2>&1) && has_config=true
@@ -486,8 +519,17 @@ run_eslint() {
                     # One run, JSON formatter: the machine-readable report feeds
                     # lint-findings.mjs and the human tail is rendered from the
                     # same report, so the two can never disagree.
-                    (cd "$WORKTREE_PATH" && npx eslint --max-warnings=0 -f json -o "$ESLINT_JSON_FILE" "${ESLINT_TARGETS[@]}" 2> "$ESLINT_TAIL_FILE") || true
-                    render_eslint_tail
+                    head_before="$(git -C "$WORKTREE_PATH" rev-parse HEAD 2>/dev/null || true)"
+                    if tracked_state="$(git -C "$WORKTREE_PATH" status --porcelain=v1 --untracked-files=no 2>/dev/null)"; then
+                        [[ -z "$tracked_state" ]] && clean_before=true
+                    fi
+                    lint_exit=0
+                    (cd "$WORKTREE_PATH" && npx eslint --max-warnings=0 -f json -o "$ESLINT_JSON_FILE" "${ESLINT_TARGETS[@]}" 2> "$ESLINT_TAIL_FILE") || lint_exit=$?
+                    head_after="$(git -C "$WORKTREE_PATH" rev-parse HEAD 2>/dev/null || true)"
+                    if tracked_state="$(git -C "$WORKTREE_PATH" status --porcelain=v1 --untracked-files=no 2>/dev/null)"; then
+                        [[ -z "$tracked_state" ]] && clean_after=true
+                    fi
+                    render_eslint_tail || true
                     printf 'changed-files' > "$ESLINT_SCOPE_FILE"
                 else
                     printf 'no-changed-lintable-files\n' > "$ESLINT_TAIL_FILE"
@@ -508,6 +550,7 @@ run_eslint() {
         printf 'skipped\n' > "$ESLINT_TAIL_FILE"
         printf 'skipped' > "$ESLINT_SCOPE_FILE"
     fi
+    write_eslint_provenance "$head_before" "$head_after" "$clean_before" "$clean_after" "$lint_exit"
 }
 
 run_tsc &
@@ -582,6 +625,7 @@ python3 - \
     "$MERGE_BASE_VAL" \
     "$DEPS_INSTALL_FILE" \
     "$ESLINT_JSON_FILE" \
+    "$ESLINT_PROVENANCE_FILE" \
     "$TEST_RUNNER_JSON" \
     "$OUT_JSON" \
     "$BASE_RULES_FILE" \
@@ -592,8 +636,8 @@ import json, sys, os
  tsc_file, eslint_file, rules_file, delta_file, notes,
  changed_files_file, base_ref_val, eslint_scope_file,
  tsc_changed_file, tsc_count_file, merge_base_val,
- deps_install_file, eslint_json_file, test_runner_json, out_json,
- base_rules_file, base_rules_state) = sys.argv[1:22]
+ deps_install_file, eslint_json_file, eslint_provenance_file, test_runner_json, out_json,
+ base_rules_file, base_rules_state) = sys.argv[1:23]
 
 def parse_runner(raw):
     try:
@@ -665,6 +709,7 @@ data = {
     # no structured report (skipped, no config, crashed, or the repo-wide
     # fallback), so a consumer can tell "no lint report" from "no problems".
     "eslintJson":     eslint_json_file if file_has_content(eslint_json_file) else None,
+    "eslintProvenance": eslint_provenance_file if file_has_content(eslint_provenance_file) else None,
 }
 
 for p in (tsc_file, eslint_file, rules_file, base_rules_file, changed_files_file,

package/plugins/olko-github-pr/skills/lekker-review/scripts/validate-lint-receipt.mjs

@@ -0,0 +1,33 @@
+import { createHash } from 'node:crypto'
+
+const FULL_SHA = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/i
+const HASH = /^[0-9a-f]{64}$/i
+const unavailable = reason => ({ status: 'unavailable', reason })
+
+export function validateLintReceipt(receipt, expected, reportBytes) {
+  if (!receipt || typeof receipt !== 'object' || Array.isArray(receipt)) return unavailable('receipt missing or malformed')
+  if (!expected || typeof expected !== 'object' || Array.isArray(expected)) return unavailable('expected provenance missing')
+  if (!(reportBytes instanceof Uint8Array)) return unavailable('raw lint report bytes unavailable')
+  if (typeof expected.baseSha !== 'string' || !FULL_SHA.test(expected.baseSha)
+      || typeof expected.headSha !== 'string' || !FULL_SHA.test(expected.headSha)) return unavailable('expected base/head must be full SHAs')
+  if (expected.trackedClean !== true) return unavailable('current tracked worktree is not clean')
+  if (receipt.schema !== 1) return unavailable('unsupported receipt schema')
+  if (receipt.status !== 'available') return unavailable(typeof receipt.reason === 'string' ? receipt.reason : 'receipt status is unavailable')
+  if (typeof receipt.baseSha !== 'string' || !FULL_SHA.test(receipt.baseSha)
+      || receipt.baseSha.toLowerCase() !== expected.baseSha.toLowerCase()) return unavailable('base SHA mismatch')
+  if (typeof receipt.headShaBefore !== 'string' || !FULL_SHA.test(receipt.headShaBefore)
+      || typeof receipt.headShaAfter !== 'string' || !FULL_SHA.test(receipt.headShaAfter)
+      || receipt.headShaBefore.toLowerCase() !== receipt.headShaAfter.toLowerCase()
+      || receipt.headShaBefore.toLowerCase() !== expected.headSha.toLowerCase()) return unavailable('head SHA mismatch or drift')
+  if (receipt.trackedCleanBefore !== true || receipt.trackedCleanAfter !== true) return unavailable('captured tracked worktree was not clean')
+  if (receipt.exitCode !== 0 && receipt.exitCode !== 1) return unavailable('invalid ESLint exit code')
+  if (typeof receipt.reportSha256 !== 'string' || !HASH.test(receipt.reportSha256)) return unavailable('report SHA-256 missing or malformed')
+  const reportSha256 = createHash('sha256').update(reportBytes).digest('hex')
+  if (reportSha256 !== receipt.reportSha256.toLowerCase()) return unavailable('lint report hash mismatch')
+  return {
+    status: 'available',
+    baseSha: receipt.baseSha, headSha: receipt.headShaBefore,
+    exitCode: receipt.exitCode, reportSha256,
+    trackedCleanBefore: receipt.trackedCleanBefore, trackedCleanAfter: receipt.trackedCleanAfter,
+  }
+}

package/plugins/olko-obsidian/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-obsidian",
   "description": "Keep an Obsidian vault in sync with work: PR sync, task rollover, morning routine.",
-  "version": "1.76.0",
+  "version": "1.78.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-product/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-product",
   "description": "Take a product idea to a shippable build: MVP passes, full-stack scaffolds, UX/UI quality loops, launch plans.",
-  "version": "1.76.0",
+  "version": "1.78.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-reflection/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-reflection",
   "description": "Look back and improve: self-critique, retrospectives, performance review, rapid learning.",
-  "version": "1.76.0",
+  "version": "1.78.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-release/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-release",
   "description": "Ship a release: semantic-release setup, changelogs, store listing copy, release-day routine.",
-  "version": "1.76.0",
+  "version": "1.78.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-skill-meta/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-skill-meta",
   "description": "Author and maintain agent skills and the AI toolchain itself.",
-  "version": "1.76.0",
+  "version": "1.78.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-web-ops/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-web-ops",
   "description": "Operate a website: WAF rules, search console audits, analytics bootstrap, docs indexes.",
-  "version": "1.76.0",
+  "version": "1.78.0",
   "author": {
     "name": "Oleg Koval"
   },