@olegkoval/agent-skills 1.77.0 → 1.78.0

package/adapters/claude/olko-github-pr/skills/lekker-review/scripts/eval-runner.mjs

@@ -2,7 +2,7 @@
 // Score lekker findings against a manifest of PRs with known outcomes.
 //
 // Usage:
-//   node eval-runner.mjs --manifest evals/manifest.json --results <results.json> [--json]
+//   node eval-runner.mjs --manifest <manifest.json> (--results <results.json> | --archive <runs-dir>) [--json]
 //
 // manifest.json: { prs: [{ repo, pr, expect: "buggy"|"clean", knownBug?: "file:line + description", id?, sha? }] }
 //                The case key is `id` when present, else "<repo>#<pr>@<sha>" when `sha` is
@@ -21,6 +21,7 @@
 // verdict-affecting finding (critical or important) is a false positive.
 
 import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 export const LINE_WINDOW = 10;
@@ -74,6 +75,7 @@ export function validateManifest(manifest) {
   return prs;
 }
 
+/** Normalize archived review evidence, returning findings only when every identity check passes. */
 export function normalizeArchivedEvidence(entry, run, worktree, document) {
   const key = caseKey(entry);
   const unscored = (reason) => ({ key, reason });
@@ -98,6 +100,7 @@ export function normalizeArchivedEvidence(entry, run, worktree, document) {
 }
 
 // Validate archive references before reading any run directories.
+/** Reject duplicate archive run IDs before archive paths are read. */
 export function validateArchiveRunIds(entries) {
   const duplicate = entries.find((entry, index) => entry.runId
     && entries.slice(0, index).some(previous => previous.runId === entry.runId));
@@ -105,6 +108,30 @@ export function validateArchiveRunIds(entries) {
   return entries;
 }
 
+function readArchiveJson(path) {
+  try { return JSON.parse(readFileSync(path, 'utf8')); } catch { return null; }
+}
+
+/** Load valid archived findings and retain a reason for each rejected run. */
+function archivedResults(entries, runsDir) {
+  const results = {};
+  const reasons = [];
+  for (const entry of entries) {
+    if (typeof entry.runId !== 'string' || !RUN_ID.test(entry.runId)) {
+      reasons.push({ key: caseKey(entry), reason: 'unsafe or missing runId' });
+      continue;
+    }
+    const dir = join(runsDir, entry.runId);
+    const evidence = normalizeArchivedEvidence(entry,
+      readArchiveJson(join(dir, 'run.json')),
+      readArchiveJson(join(dir, 'worktree.json')),
+      readArchiveJson(join(dir, 'findings.json')));
+    if (evidence.reason) reasons.push({ key: evidence.key, reason: evidence.reason });
+    else results[evidence.key] = evidence.findings;
+  }
+  return { results, reasons };
+}
+
 export function score(manifest, results) {
   const rows = validateManifest(manifest).map((e) => {
     const key = caseKey(e);
@@ -147,12 +174,24 @@ export function score(manifest, results) {
 
 function main(argv) {
   const flag = (n) => { const i = argv.indexOf('--' + n); return i === -1 ? null : argv[i + 1]; };
-  if (!flag('manifest') || !flag('results')) {
-    console.error('usage: eval-runner.mjs --manifest <manifest.json> --results <results.json> [--json]');
+  const results = flag('results');
+  const archiveIndex = argv.indexOf('--archive');
+  const archive = archiveIndex === -1 ? null : argv[archiveIndex + 1];
+  const resultsIndex = argv.indexOf('--results');
+  if (!flag('manifest') || (archiveIndex !== -1 && (!archive || archive.startsWith('--')))
+      || (resultsIndex !== -1 && (!results || results.startsWith('--')))
+      || Boolean(results) === Boolean(archive)) {
+    console.error('usage: eval-runner.mjs --manifest <manifest.json> (--results <results.json> | --archive <runs-dir>) [--json]');
     process.exit(2);
   }
-  const out = score(JSON.parse(readFileSync(flag('manifest'), 'utf8')), JSON.parse(readFileSync(flag('results'), 'utf8')));
+  const manifest = JSON.parse(readFileSync(flag('manifest'), 'utf8'));
+  const source = archive
+    ? archivedResults(validateArchiveRunIds(validateManifest(manifest)), archive)
+    : { results: JSON.parse(readFileSync(results, 'utf8')), reasons: null };
+  const out = score(manifest, source.results);
+  if (source.reasons) out.unscoredReasons = source.reasons;
   if (argv.includes('--json')) { console.log(JSON.stringify(out)); return; }
+  for (const { key, reason } of source.reasons || []) console.error(`unscored ${key}: ${reason}`);
   const pct = (x) => (x === null ? 'n/a' : `${Math.round(x * 100)}%`);
   if (out.buggyRuns === undefined) {
     console.log(`recall ${pct(out.recall)} (${out.buggyScored} buggy scored), false positives ${out.falsePositives} (${out.cleanScored} clean scored), unscored ${out.unscored.length}`);

package/adapters/claude/olko-github-pr/skills/lekker-review/scripts/evidence-bundle.mjs

@@ -0,0 +1,39 @@
+#!/usr/bin/env node
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { collectGitEvidence } from './git-evidence.mjs';
+import { validateLintReceipt } from './validate-lint-receipt.mjs';
+
+const record = value => value && typeof value === 'object' && !Array.isArray(value);
+const unavailableLint = reason => ({ captureStatus: 'unavailable', reason });
+const unavailableBundle = reason => ({ schema: 1,
+  git: { schema: 1, status: 'unavailable', reason }, lint: unavailableLint(reason) });
+
+export function collectEvidence(worktreeMetadata) {
+  if (!record(worktreeMetadata)) return unavailableBundle('worktree metadata is missing or malformed');
+  const git = collectGitEvidence({ worktreePath: worktreeMetadata.worktreePath,
+    mergeBase: worktreeMetadata.mergeBase, headSha: worktreeMetadata.headSha });
+  if (git.status !== 'available') return { schema: 1, git, lint: unavailableLint(`Git evidence unavailable: ${git.reason}`) };
+  if (typeof worktreeMetadata.eslintJson !== 'string' || !worktreeMetadata.eslintJson) return { schema: 1, git, lint: unavailableLint('lint report path unavailable') };
+  if (typeof worktreeMetadata.eslintProvenance !== 'string' || !worktreeMetadata.eslintProvenance) return { schema: 1, git, lint: unavailableLint('lint provenance path unavailable') };
+  let reportBytes, receipt;
+  try { reportBytes = readFileSync(worktreeMetadata.eslintJson); } catch { return { schema: 1, git, lint: unavailableLint('lint report could not be read') }; }
+  try { receipt = JSON.parse(readFileSync(worktreeMetadata.eslintProvenance, 'utf8')); } catch { return { schema: 1, git, lint: unavailableLint('lint provenance is missing or malformed') }; }
+  const provenance = validateLintReceipt(receipt, { baseSha: git.provenance.baseSha,
+    headSha: git.provenance.headSha, trackedClean: git.provenance.trackedCleanBefore && git.provenance.trackedCleanAfter }, reportBytes);
+  if (provenance.status !== 'available') return { schema: 1, git, lint: unavailableLint(provenance.reason) };
+  let report;
+  try { report = JSON.parse(reportBytes.toString('utf8')); } catch { return { schema: 1, git, lint: unavailableLint('lint report is malformed JSON') }; }
+  if (!Array.isArray(report)) return { schema: 1, git, lint: unavailableLint('lint report is not a JSON array') };
+  return { schema: 1, git, lint: { captureStatus: 'available', exitCode: provenance.exitCode,
+    reportSha256: provenance.reportSha256, report } };
+}
+
+function main(argv) {
+  const i = argv.indexOf('--worktree'), path = i < 0 ? null : argv[i + 1];
+  if (!path || path.startsWith('--')) { console.error('usage: evidence-bundle.mjs --worktree <worktree.json>'); process.exitCode = 2; return; }
+  try { console.log(JSON.stringify(collectEvidence(JSON.parse(readFileSync(path, 'utf8'))))); }
+  catch { console.log(JSON.stringify(unavailableBundle('worktree metadata could not be read'))); process.exitCode = 2; }
+}
+
+if (process.argv[1] === fileURLToPath(import.meta.url)) main(process.argv.slice(2));

package/adapters/claude/olko-github-pr/skills/lekker-review/scripts/native-completion.mjs

@@ -0,0 +1,39 @@
+import { createHash } from 'node:crypto';
+
+const DIMENSIONS = {
+  deps: ['deps'],
+  scan: ['triage-quality', 'triage-logic', 'project-rules'],
+  medium: ['quality', 'implementation', 'simplification', 'conventions', 'test-quality', 'project-rules'],
+  deep: ['quality', 'implementation', 'simplification', 'conventions', 'test-quality', 'project-rules'],
+};
+const SHA = /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/i;
+const HASH = /^[a-f0-9]{64}$/i;
+const record = value => value && typeof value === 'object' && !Array.isArray(value);
+const count = value => Number.isSafeInteger(value) && value >= 0;
+
+/** Validate a native completion receipt against run policy and exact findings bytes. */
+export function validateNativeCompletion(receipt, expected, findingsBytes) {
+  const unavailable = reason => ({ available: false, reason });
+  if (!record(expected) || !record(expected.eligible) || !record(receipt)) return unavailable('receipt or expected inputs are malformed');
+  if (!['deps', 'scan', 'medium', 'deep'].includes(expected.depth) || typeof expected.worktreeAvailable !== 'boolean'
+      || !count(expected.eligible.verify) || !count(expected.eligible.prove)) return unavailable('expected policy inputs are malformed');
+  if (typeof expected.runId !== 'string' || !expected.runId || typeof expected.headSha !== 'string' || !SHA.test(expected.headSha)) return unavailable('expected identity is malformed');
+  if (!(findingsBytes instanceof Uint8Array)) return unavailable('findings bytes are unavailable');
+  if (receipt.schema !== 1 || receipt.engine !== 'codex' || receipt.status !== 'complete') return unavailable('native completion is not complete');
+  if (receipt.runId !== expected.runId || receipt.depth !== expected.depth) return unavailable('run identity or depth mismatch');
+  if (typeof receipt.headSha !== 'string' || !SHA.test(receipt.headSha) || receipt.headSha.toLowerCase() !== expected.headSha.toLowerCase()) return unavailable('head SHA mismatch');
+  if (typeof receipt.findingsSha256 !== 'string' || !HASH.test(receipt.findingsSha256)
+      || createHash('sha256').update(findingsBytes).digest('hex') !== receipt.findingsSha256.toLowerCase()) return unavailable('findings hash mismatch');
+  const required = DIMENSIONS[expected.depth];
+  if (!Array.isArray(receipt.dimensions) || receipt.dimensions.length !== required.length) return unavailable('required review dimensions are missing or duplicated');
+  const dimensions = Array.from(receipt.dimensions);
+  if (dimensions.some(d => !record(d) || !required.includes(d.name) || d.status !== 'completed')) return unavailable('review dimensions are missing, unknown, or incomplete');
+  if (new Set(dimensions.map(d => d.name)).size !== required.length) return unavailable('review dimensions are duplicated');
+  const verify = expected.depth === 'deps' ? 0 : expected.eligible.verify;
+  const prove = ['medium', 'deep'].includes(expected.depth) && expected.worktreeAvailable ? Math.min(5, expected.eligible.prove) : 0;
+  const validStage = (stage, scheduled) => record(stage) && count(stage.scheduled) && count(stage.completed)
+    && count(stage.failed) && stage.scheduled === scheduled && stage.completed === scheduled && stage.failed === 0;
+  if (!record(receipt.stages) || !validStage(receipt.stages.verify, verify) || !validStage(receipt.stages.prove, prove)) return unavailable('verification or proof stage accounting is incomplete');
+  if (receipt.stages.critic !== (expected.depth === 'deep' ? 'completed' : 'not_required')) return unavailable('critic stage status does not match depth');
+  return { available: true, reason: null };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@olegkoval/agent-skills",
-  "version": "1.77.0",
+  "version": "1.78.0",
   "private": false,
   "publishConfig": {
     "access": "public"

package/plugins/olko-apple-kit/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-apple-kit",
   "description": "Build and ship Apple platform apps: macOS menubar apps, App Store submissions.",
-  "version": "1.77.0",
+  "version": "1.78.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-creative/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-creative",
   "description": "Creative and personal projects: photo galleries, music players, listings, wiki editing.",
-  "version": "1.77.0",
+  "version": "1.78.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-garmin-kit/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-garmin-kit",
   "description": "Build, test and publish Garmin Connect IQ watch faces.",
-  "version": "1.77.0",
+  "version": "1.78.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-git-tools/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-git-tools",
   "description": "Everyday git and GitHub CLI operations: conventional commits, branch hygiene.",
-  "version": "1.77.0",
+  "version": "1.78.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-github-pr/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-github-pr",
   "description": "Drive GitHub pull requests to merge-ready: review-bot loops, CI fixes, descriptions, dependency triage.",
-  "version": "1.77.0",
+  "version": "1.78.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-github-pr/skills/lekker-review/scripts/eval-runner.mjs

@@ -2,7 +2,7 @@
 // Score lekker findings against a manifest of PRs with known outcomes.
 //
 // Usage:
-//   node eval-runner.mjs --manifest evals/manifest.json --results <results.json> [--json]
+//   node eval-runner.mjs --manifest <manifest.json> (--results <results.json> | --archive <runs-dir>) [--json]
 //
 // manifest.json: { prs: [{ repo, pr, expect: "buggy"|"clean", knownBug?: "file:line + description", id?, sha? }] }
 //                The case key is `id` when present, else "<repo>#<pr>@<sha>" when `sha` is
@@ -21,6 +21,7 @@
 // verdict-affecting finding (critical or important) is a false positive.
 
 import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 export const LINE_WINDOW = 10;
@@ -74,6 +75,7 @@ export function validateManifest(manifest) {
   return prs;
 }
 
+/** Normalize archived review evidence, returning findings only when every identity check passes. */
 export function normalizeArchivedEvidence(entry, run, worktree, document) {
   const key = caseKey(entry);
   const unscored = (reason) => ({ key, reason });
@@ -98,6 +100,7 @@ export function normalizeArchivedEvidence(entry, run, worktree, document) {
 }
 
 // Validate archive references before reading any run directories.
+/** Reject duplicate archive run IDs before archive paths are read. */
 export function validateArchiveRunIds(entries) {
   const duplicate = entries.find((entry, index) => entry.runId
     && entries.slice(0, index).some(previous => previous.runId === entry.runId));
@@ -105,6 +108,30 @@ export function validateArchiveRunIds(entries) {
   return entries;
 }
 
+function readArchiveJson(path) {
+  try { return JSON.parse(readFileSync(path, 'utf8')); } catch { return null; }
+}
+
+/** Load valid archived findings and retain a reason for each rejected run. */
+function archivedResults(entries, runsDir) {
+  const results = {};
+  const reasons = [];
+  for (const entry of entries) {
+    if (typeof entry.runId !== 'string' || !RUN_ID.test(entry.runId)) {
+      reasons.push({ key: caseKey(entry), reason: 'unsafe or missing runId' });
+      continue;
+    }
+    const dir = join(runsDir, entry.runId);
+    const evidence = normalizeArchivedEvidence(entry,
+      readArchiveJson(join(dir, 'run.json')),
+      readArchiveJson(join(dir, 'worktree.json')),
+      readArchiveJson(join(dir, 'findings.json')));
+    if (evidence.reason) reasons.push({ key: evidence.key, reason: evidence.reason });
+    else results[evidence.key] = evidence.findings;
+  }
+  return { results, reasons };
+}
+
 export function score(manifest, results) {
   const rows = validateManifest(manifest).map((e) => {
     const key = caseKey(e);
@@ -147,12 +174,24 @@ export function score(manifest, results) {
 
 function main(argv) {
   const flag = (n) => { const i = argv.indexOf('--' + n); return i === -1 ? null : argv[i + 1]; };
-  if (!flag('manifest') || !flag('results')) {
-    console.error('usage: eval-runner.mjs --manifest <manifest.json> --results <results.json> [--json]');
+  const results = flag('results');
+  const archiveIndex = argv.indexOf('--archive');
+  const archive = archiveIndex === -1 ? null : argv[archiveIndex + 1];
+  const resultsIndex = argv.indexOf('--results');
+  if (!flag('manifest') || (archiveIndex !== -1 && (!archive || archive.startsWith('--')))
+      || (resultsIndex !== -1 && (!results || results.startsWith('--')))
+      || Boolean(results) === Boolean(archive)) {
+    console.error('usage: eval-runner.mjs --manifest <manifest.json> (--results <results.json> | --archive <runs-dir>) [--json]');
     process.exit(2);
   }
-  const out = score(JSON.parse(readFileSync(flag('manifest'), 'utf8')), JSON.parse(readFileSync(flag('results'), 'utf8')));
+  const manifest = JSON.parse(readFileSync(flag('manifest'), 'utf8'));
+  const source = archive
+    ? archivedResults(validateArchiveRunIds(validateManifest(manifest)), archive)
+    : { results: JSON.parse(readFileSync(results, 'utf8')), reasons: null };
+  const out = score(manifest, source.results);
+  if (source.reasons) out.unscoredReasons = source.reasons;
   if (argv.includes('--json')) { console.log(JSON.stringify(out)); return; }
+  for (const { key, reason } of source.reasons || []) console.error(`unscored ${key}: ${reason}`);
   const pct = (x) => (x === null ? 'n/a' : `${Math.round(x * 100)}%`);
   if (out.buggyRuns === undefined) {
     console.log(`recall ${pct(out.recall)} (${out.buggyScored} buggy scored), false positives ${out.falsePositives} (${out.cleanScored} clean scored), unscored ${out.unscored.length}`);

package/plugins/olko-github-pr/skills/lekker-review/scripts/evidence-bundle.mjs

@@ -0,0 +1,39 @@
+#!/usr/bin/env node
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { collectGitEvidence } from './git-evidence.mjs';
+import { validateLintReceipt } from './validate-lint-receipt.mjs';
+
+const record = value => value && typeof value === 'object' && !Array.isArray(value);
+const unavailableLint = reason => ({ captureStatus: 'unavailable', reason });
+const unavailableBundle = reason => ({ schema: 1,
+  git: { schema: 1, status: 'unavailable', reason }, lint: unavailableLint(reason) });
+
+export function collectEvidence(worktreeMetadata) {
+  if (!record(worktreeMetadata)) return unavailableBundle('worktree metadata is missing or malformed');
+  const git = collectGitEvidence({ worktreePath: worktreeMetadata.worktreePath,
+    mergeBase: worktreeMetadata.mergeBase, headSha: worktreeMetadata.headSha });
+  if (git.status !== 'available') return { schema: 1, git, lint: unavailableLint(`Git evidence unavailable: ${git.reason}`) };
+  if (typeof worktreeMetadata.eslintJson !== 'string' || !worktreeMetadata.eslintJson) return { schema: 1, git, lint: unavailableLint('lint report path unavailable') };
+  if (typeof worktreeMetadata.eslintProvenance !== 'string' || !worktreeMetadata.eslintProvenance) return { schema: 1, git, lint: unavailableLint('lint provenance path unavailable') };
+  let reportBytes, receipt;
+  try { reportBytes = readFileSync(worktreeMetadata.eslintJson); } catch { return { schema: 1, git, lint: unavailableLint('lint report could not be read') }; }
+  try { receipt = JSON.parse(readFileSync(worktreeMetadata.eslintProvenance, 'utf8')); } catch { return { schema: 1, git, lint: unavailableLint('lint provenance is missing or malformed') }; }
+  const provenance = validateLintReceipt(receipt, { baseSha: git.provenance.baseSha,
+    headSha: git.provenance.headSha, trackedClean: git.provenance.trackedCleanBefore && git.provenance.trackedCleanAfter }, reportBytes);
+  if (provenance.status !== 'available') return { schema: 1, git, lint: unavailableLint(provenance.reason) };
+  let report;
+  try { report = JSON.parse(reportBytes.toString('utf8')); } catch { return { schema: 1, git, lint: unavailableLint('lint report is malformed JSON') }; }
+  if (!Array.isArray(report)) return { schema: 1, git, lint: unavailableLint('lint report is not a JSON array') };
+  return { schema: 1, git, lint: { captureStatus: 'available', exitCode: provenance.exitCode,
+    reportSha256: provenance.reportSha256, report } };
+}
+
+function main(argv) {
+  const i = argv.indexOf('--worktree'), path = i < 0 ? null : argv[i + 1];
+  if (!path || path.startsWith('--')) { console.error('usage: evidence-bundle.mjs --worktree <worktree.json>'); process.exitCode = 2; return; }
+  try { console.log(JSON.stringify(collectEvidence(JSON.parse(readFileSync(path, 'utf8'))))); }
+  catch { console.log(JSON.stringify(unavailableBundle('worktree metadata could not be read'))); process.exitCode = 2; }
+}
+
+if (process.argv[1] === fileURLToPath(import.meta.url)) main(process.argv.slice(2));

package/plugins/olko-github-pr/skills/lekker-review/scripts/native-completion.mjs

@@ -0,0 +1,39 @@
+import { createHash } from 'node:crypto';
+
+const DIMENSIONS = {
+  deps: ['deps'],
+  scan: ['triage-quality', 'triage-logic', 'project-rules'],
+  medium: ['quality', 'implementation', 'simplification', 'conventions', 'test-quality', 'project-rules'],
+  deep: ['quality', 'implementation', 'simplification', 'conventions', 'test-quality', 'project-rules'],
+};
+const SHA = /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/i;
+const HASH = /^[a-f0-9]{64}$/i;
+const record = value => value && typeof value === 'object' && !Array.isArray(value);
+const count = value => Number.isSafeInteger(value) && value >= 0;
+
+/** Validate a native completion receipt against run policy and exact findings bytes. */
+export function validateNativeCompletion(receipt, expected, findingsBytes) {
+  const unavailable = reason => ({ available: false, reason });
+  if (!record(expected) || !record(expected.eligible) || !record(receipt)) return unavailable('receipt or expected inputs are malformed');
+  if (!['deps', 'scan', 'medium', 'deep'].includes(expected.depth) || typeof expected.worktreeAvailable !== 'boolean'
+      || !count(expected.eligible.verify) || !count(expected.eligible.prove)) return unavailable('expected policy inputs are malformed');
+  if (typeof expected.runId !== 'string' || !expected.runId || typeof expected.headSha !== 'string' || !SHA.test(expected.headSha)) return unavailable('expected identity is malformed');
+  if (!(findingsBytes instanceof Uint8Array)) return unavailable('findings bytes are unavailable');
+  if (receipt.schema !== 1 || receipt.engine !== 'codex' || receipt.status !== 'complete') return unavailable('native completion is not complete');
+  if (receipt.runId !== expected.runId || receipt.depth !== expected.depth) return unavailable('run identity or depth mismatch');
+  if (typeof receipt.headSha !== 'string' || !SHA.test(receipt.headSha) || receipt.headSha.toLowerCase() !== expected.headSha.toLowerCase()) return unavailable('head SHA mismatch');
+  if (typeof receipt.findingsSha256 !== 'string' || !HASH.test(receipt.findingsSha256)
+      || createHash('sha256').update(findingsBytes).digest('hex') !== receipt.findingsSha256.toLowerCase()) return unavailable('findings hash mismatch');
+  const required = DIMENSIONS[expected.depth];
+  if (!Array.isArray(receipt.dimensions) || receipt.dimensions.length !== required.length) return unavailable('required review dimensions are missing or duplicated');
+  const dimensions = Array.from(receipt.dimensions);
+  if (dimensions.some(d => !record(d) || !required.includes(d.name) || d.status !== 'completed')) return unavailable('review dimensions are missing, unknown, or incomplete');
+  if (new Set(dimensions.map(d => d.name)).size !== required.length) return unavailable('review dimensions are duplicated');
+  const verify = expected.depth === 'deps' ? 0 : expected.eligible.verify;
+  const prove = ['medium', 'deep'].includes(expected.depth) && expected.worktreeAvailable ? Math.min(5, expected.eligible.prove) : 0;
+  const validStage = (stage, scheduled) => record(stage) && count(stage.scheduled) && count(stage.completed)
+    && count(stage.failed) && stage.scheduled === scheduled && stage.completed === scheduled && stage.failed === 0;
+  if (!record(receipt.stages) || !validStage(receipt.stages.verify, verify) || !validStage(receipt.stages.prove, prove)) return unavailable('verification or proof stage accounting is incomplete');
+  if (receipt.stages.critic !== (expected.depth === 'deep' ? 'completed' : 'not_required')) return unavailable('critic stage status does not match depth');
+  return { available: true, reason: null };
+}

package/plugins/olko-obsidian/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-obsidian",
   "description": "Keep an Obsidian vault in sync with work: PR sync, task rollover, morning routine.",
-  "version": "1.77.0",
+  "version": "1.78.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-product/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-product",
   "description": "Take a product idea to a shippable build: MVP passes, full-stack scaffolds, UX/UI quality loops, launch plans.",
-  "version": "1.77.0",
+  "version": "1.78.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-reflection/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-reflection",
   "description": "Look back and improve: self-critique, retrospectives, performance review, rapid learning.",
-  "version": "1.77.0",
+  "version": "1.78.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-release/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-release",
   "description": "Ship a release: semantic-release setup, changelogs, store listing copy, release-day routine.",
-  "version": "1.77.0",
+  "version": "1.78.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-skill-meta/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-skill-meta",
   "description": "Author and maintain agent skills and the AI toolchain itself.",
-  "version": "1.77.0",
+  "version": "1.78.0",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-web-ops/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-web-ops",
   "description": "Operate a website: WAF rules, search console audits, analytics bootstrap, docs indexes.",
-  "version": "1.77.0",
+  "version": "1.78.0",
   "author": {
     "name": "Oleg Koval"
   },