@olegkoval/agent-skills 1.77.0 → 1.78.1

package/adapters/claude/olko-github-pr/skills/lekker-review/scripts/eval-runner.mjs

@@ -2,7 +2,7 @@
 // Score lekker findings against a manifest of PRs with known outcomes.
 //
 // Usage:
-//   node eval-runner.mjs --manifest evals/manifest.json --results <results.json> [--json]
+//   node eval-runner.mjs --manifest <manifest.json> (--results <results.json> | --archive <runs-dir>) [--json]
 //
 // manifest.json: { prs: [{ repo, pr, expect: "buggy"|"clean", knownBug?: "file:line + description", id?, sha? }] }
 //                The case key is `id` when present, else "<repo>#<pr>@<sha>" when `sha` is
@@ -21,6 +21,7 @@
 // verdict-affecting finding (critical or important) is a false positive.
 
 import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 export const LINE_WINDOW = 10;
@@ -74,6 +75,7 @@ export function validateManifest(manifest) {
   return prs;
 }
 
+/** Normalize archived review evidence, returning findings only when every identity check passes. */
 export function normalizeArchivedEvidence(entry, run, worktree, document) {
   const key = caseKey(entry);
   const unscored = (reason) => ({ key, reason });
@@ -98,6 +100,7 @@ export function normalizeArchivedEvidence(entry, run, worktree, document) {
 }
 
 // Validate archive references before reading any run directories.
+/** Reject duplicate archive run IDs before archive paths are read. */
 export function validateArchiveRunIds(entries) {
   const duplicate = entries.find((entry, index) => entry.runId
     && entries.slice(0, index).some(previous => previous.runId === entry.runId));
@@ -105,6 +108,30 @@ export function validateArchiveRunIds(entries) {
   return entries;
 }
 
+function readArchiveJson(path) {
+  try { return JSON.parse(readFileSync(path, 'utf8')); } catch { return null; }
+}
+
+/** Load valid archived findings and retain a reason for each rejected run. */
+function archivedResults(entries, runsDir) {
+  const results = {};
+  const reasons = [];
+  for (const entry of entries) {
+    if (typeof entry.runId !== 'string' || !RUN_ID.test(entry.runId)) {
+      reasons.push({ key: caseKey(entry), reason: 'unsafe or missing runId' });
+      continue;
+    }
+    const dir = join(runsDir, entry.runId);
+    const evidence = normalizeArchivedEvidence(entry,
+      readArchiveJson(join(dir, 'run.json')),
+      readArchiveJson(join(dir, 'worktree.json')),
+      readArchiveJson(join(dir, 'findings.json')));
+    if (evidence.reason) reasons.push({ key: evidence.key, reason: evidence.reason });
+    else results[evidence.key] = evidence.findings;
+  }
+  return { results, reasons };
+}
+
 export function score(manifest, results) {
   const rows = validateManifest(manifest).map((e) => {
     const key = caseKey(e);
@@ -147,12 +174,24 @@ export function score(manifest, results) {
 
 function main(argv) {
   const flag = (n) => { const i = argv.indexOf('--' + n); return i === -1 ? null : argv[i + 1]; };
-  if (!flag('manifest') || !flag('results')) {
-    console.error('usage: eval-runner.mjs --manifest <manifest.json> --results <results.json> [--json]');
+  const results = flag('results');
+  const archiveIndex = argv.indexOf('--archive');
+  const archive = archiveIndex === -1 ? null : argv[archiveIndex + 1];
+  const resultsIndex = argv.indexOf('--results');
+  if (!flag('manifest') || (archiveIndex !== -1 && (!archive || archive.startsWith('--')))
+      || (resultsIndex !== -1 && (!results || results.startsWith('--')))
+      || Boolean(results) === Boolean(archive)) {
+    console.error('usage: eval-runner.mjs --manifest <manifest.json> (--results <results.json> | --archive <runs-dir>) [--json]');
     process.exit(2);
   }
-  const out = score(JSON.parse(readFileSync(flag('manifest'), 'utf8')), JSON.parse(readFileSync(flag('results'), 'utf8')));
+  const manifest = JSON.parse(readFileSync(flag('manifest'), 'utf8'));
+  const source = archive
+    ? archivedResults(validateArchiveRunIds(validateManifest(manifest)), archive)
+    : { results: JSON.parse(readFileSync(results, 'utf8')), reasons: null };
+  const out = score(manifest, source.results);
+  if (source.reasons) out.unscoredReasons = source.reasons;
   if (argv.includes('--json')) { console.log(JSON.stringify(out)); return; }
+  for (const { key, reason } of source.reasons || []) console.error(`unscored ${key}: ${reason}`);
   const pct = (x) => (x === null ? 'n/a' : `${Math.round(x * 100)}%`);
   if (out.buggyRuns === undefined) {
     console.log(`recall ${pct(out.recall)} (${out.buggyScored} buggy scored), false positives ${out.falsePositives} (${out.cleanScored} clean scored), unscored ${out.unscored.length}`);

package/adapters/claude/olko-github-pr/skills/lekker-review/scripts/evidence-bundle.mjs

@@ -0,0 +1,39 @@
+#!/usr/bin/env node
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { collectGitEvidence } from './git-evidence.mjs';
+import { validateLintReceipt } from './validate-lint-receipt.mjs';
+
+const record = value => value && typeof value === 'object' && !Array.isArray(value);
+const unavailableLint = reason => ({ captureStatus: 'unavailable', reason });
+const unavailableBundle = reason => ({ schema: 1,
+  git: { schema: 1, status: 'unavailable', reason }, lint: unavailableLint(reason) });
+
+export function collectEvidence(worktreeMetadata) {
+  if (!record(worktreeMetadata)) return unavailableBundle('worktree metadata is missing or malformed');
+  const git = collectGitEvidence({ worktreePath: worktreeMetadata.worktreePath,
+    mergeBase: worktreeMetadata.mergeBase, headSha: worktreeMetadata.headSha });
+  if (git.status !== 'available') return { schema: 1, git, lint: unavailableLint(`Git evidence unavailable: ${git.reason}`) };
+  if (typeof worktreeMetadata.eslintJson !== 'string' || !worktreeMetadata.eslintJson) return { schema: 1, git, lint: unavailableLint('lint report path unavailable') };
+  if (typeof worktreeMetadata.eslintProvenance !== 'string' || !worktreeMetadata.eslintProvenance) return { schema: 1, git, lint: unavailableLint('lint provenance path unavailable') };
+  let reportBytes, receipt;
+  try { reportBytes = readFileSync(worktreeMetadata.eslintJson); } catch { return { schema: 1, git, lint: unavailableLint('lint report could not be read') }; }
+  try { receipt = JSON.parse(readFileSync(worktreeMetadata.eslintProvenance, 'utf8')); } catch { return { schema: 1, git, lint: unavailableLint('lint provenance is missing or malformed') }; }
+  const provenance = validateLintReceipt(receipt, { baseSha: git.provenance.baseSha,
+    headSha: git.provenance.headSha, trackedClean: git.provenance.trackedCleanBefore && git.provenance.trackedCleanAfter }, reportBytes);
+  if (provenance.status !== 'available') return { schema: 1, git, lint: unavailableLint(provenance.reason) };
+  let report;
+  try { report = JSON.parse(reportBytes.toString('utf8')); } catch { return { schema: 1, git, lint: unavailableLint('lint report is malformed JSON') }; }
+  if (!Array.isArray(report)) return { schema: 1, git, lint: unavailableLint('lint report is not a JSON array') };
+  return { schema: 1, git, lint: { captureStatus: 'available', exitCode: provenance.exitCode,
+    reportSha256: provenance.reportSha256, report } };
+}
+
+function main(argv) {
+  const i = argv.indexOf('--worktree'), path = i < 0 ? null : argv[i + 1];
+  if (!path || path.startsWith('--')) { console.error('usage: evidence-bundle.mjs --worktree <worktree.json>'); process.exitCode = 2; return; }
+  try { console.log(JSON.stringify(collectEvidence(JSON.parse(readFileSync(path, 'utf8'))))); }
+  catch { console.log(JSON.stringify(unavailableBundle('worktree metadata could not be read'))); process.exitCode = 2; }
+}
+
+if (process.argv[1] === fileURLToPath(import.meta.url)) main(process.argv.slice(2));

package/adapters/claude/olko-github-pr/skills/lekker-review/scripts/native-completion.mjs

@@ -0,0 +1,39 @@
+import { createHash } from 'node:crypto';
+
+const DIMENSIONS = {
+  deps: ['deps'],
+  scan: ['triage-quality', 'triage-logic', 'project-rules'],
+  medium: ['quality', 'implementation', 'simplification', 'conventions', 'test-quality', 'project-rules'],
+  deep: ['quality', 'implementation', 'simplification', 'conventions', 'test-quality', 'project-rules'],
+};
+const SHA = /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/i;
+const HASH = /^[a-f0-9]{64}$/i;
+const record = value => value && typeof value === 'object' && !Array.isArray(value);
+const count = value => Number.isSafeInteger(value) && value >= 0;
+
+/** Validate a native completion receipt against run policy and exact findings bytes. */
+export function validateNativeCompletion(receipt, expected, findingsBytes) {
+  const unavailable = reason => ({ available: false, reason });
+  if (!record(expected) || !record(expected.eligible) || !record(receipt)) return unavailable('receipt or expected inputs are malformed');
+  if (!['deps', 'scan', 'medium', 'deep'].includes(expected.depth) || typeof expected.worktreeAvailable !== 'boolean'
+      || !count(expected.eligible.verify) || !count(expected.eligible.prove)) return unavailable('expected policy inputs are malformed');
+  if (typeof expected.runId !== 'string' || !expected.runId || typeof expected.headSha !== 'string' || !SHA.test(expected.headSha)) return unavailable('expected identity is malformed');
+  if (!(findingsBytes instanceof Uint8Array)) return unavailable('findings bytes are unavailable');
+  if (receipt.schema !== 1 || receipt.engine !== 'codex' || receipt.status !== 'complete') return unavailable('native completion is not complete');
+  if (receipt.runId !== expected.runId || receipt.depth !== expected.depth) return unavailable('run identity or depth mismatch');
+  if (typeof receipt.headSha !== 'string' || !SHA.test(receipt.headSha) || receipt.headSha.toLowerCase() !== expected.headSha.toLowerCase()) return unavailable('head SHA mismatch');
+  if (typeof receipt.findingsSha256 !== 'string' || !HASH.test(receipt.findingsSha256)
+      || createHash('sha256').update(findingsBytes).digest('hex') !== receipt.findingsSha256.toLowerCase()) return unavailable('findings hash mismatch');
+  const required = DIMENSIONS[expected.depth];
+  if (!Array.isArray(receipt.dimensions) || receipt.dimensions.length !== required.length) return unavailable('required review dimensions are missing or duplicated');
+  const dimensions = Array.from(receipt.dimensions);
+  if (dimensions.some(d => !record(d) || !required.includes(d.name) || d.status !== 'completed')) return unavailable('review dimensions are missing, unknown, or incomplete');
+  if (new Set(dimensions.map(d => d.name)).size !== required.length) return unavailable('review dimensions are duplicated');
+  const verify = expected.depth === 'deps' ? 0 : expected.eligible.verify;
+  const prove = ['medium', 'deep'].includes(expected.depth) && expected.worktreeAvailable ? Math.min(5, expected.eligible.prove) : 0;
+  const validStage = (stage, scheduled) => record(stage) && count(stage.scheduled) && count(stage.completed)
+    && count(stage.failed) && stage.scheduled === scheduled && stage.completed === scheduled && stage.failed === 0;
+  if (!record(receipt.stages) || !validStage(receipt.stages.verify, verify) || !validStage(receipt.stages.prove, prove)) return unavailable('verification or proof stage accounting is incomplete');
+  if (receipt.stages.critic !== (expected.depth === 'deep' ? 'completed' : 'not_required')) return unavailable('critic stage status does not match depth');
+  return { available: true, reason: null };
+}

package/docs/lekker-openrewrite-pilot.md

@@ -0,0 +1,94 @@
+# OpenRewrite native JavaScript pilot
+
+This optional fixture experiment runs a shipped OpenRewrite recipe without the
+Moderne CLI. It adds no default review dependency and applies no source fixes.
+It tests a concrete static-analysis opportunity while all six semantic review
+dimensions and Verify/Critic/Prove remain required.
+
+## Reproduce in isolation
+
+Requires npm and Docker. Run from this repository's root. Installation disables
+package lifecycle scripts. The recipe runs with no network, host mounts or
+forwarded credentials; only the temporary fixture project enters the container.
+
+```sh
+pilot_dir=$(mktemp -d)
+npm install --prefix "$pilot_dir" --ignore-scripts --omit=optional \
+  --no-audit --no-fund --save-exact @openrewrite/rewrite@8.100.3
+cp tests/openrewrite-pilot.mjs "$pilot_dir/pilot.mjs"
+pilot_container=$(docker create --network none --cap-drop ALL \
+  --security-opt no-new-privileges --memory 1g --pids-limit 128 --workdir /work \
+  node@sha256:0e1754758c2df4cfa3e68d59e2e1b7374bb7fd9ea6328eaaacf15cc934af8202 \
+  node pilot.mjs)
+docker cp "$pilot_dir/." "$pilot_container:/work"
+docker start -a "$pilot_container" > "$pilot_dir/first.stdout" 2> "$pilot_dir/first.stderr"
+docker inspect "$pilot_container" --format '{{.State.ExitCode}}'
+docker cp "$pilot_container:/work/artifacts" "$pilot_dir/first-artifacts"
+docker start -a "$pilot_container" > "$pilot_dir/second.stdout" 2> "$pilot_dir/second.stderr"
+docker inspect "$pilot_container" --format '{{.State.ExitCode}}'
+docker cp "$pilot_container:/work/artifacts" "$pilot_dir/second-artifacts"
+```
+
+Both exit codes must be zero. Each process checks its two fresh-input passes
+for identical normalized output and validates every expected result. Compare
+the `outputSha256` values across the two stdout files as a separate cold-process
+repeatability gate. Preserve stderr, package-lock.json, expectations, outputs and
+patches before removing the stopped container and temporary directory. A failed
+process is unavailable evidence, never a clean review. No fixtures execute the
+JavaScript being analyzed.
+
+## Frozen experiment
+
+Package: `@openrewrite/rewrite@8.100.3`.
+Tested runtime: Node v22.23.4 in the pinned Linux/arm64 container image above.
+Recipe: `org.openrewrite.javascript.cleanup.async-callback-in-sync-array-method`.
+The harness uses the package's JavaScriptParser, scheduleRun and TreePrinters;
+it implements no substitute detection rule.
+
+| Fixture | Expected and observed |
+|---|---|
+| Array.filter with async callback | Warning |
+| Array.forEach with async callback | Warning |
+| Array.filter with sync callback | Unchanged |
+| Array.map with async callback | Unchanged |
+| Typed custom filter accepting async callback | Unchanged |
+| Known-safe custom filter with erased receiver type | Warning: characterized false positive |
+| Invalid TypeScript syntax | Parse-error / unavailable |
+
+The extra untyped custom filter returns the callback's promise to its caller;
+unlike Array.filter, it never interprets that promise as a boolean. The warning
+is therefore not a demonstrated defect. Its expected warning characterizes the
+recipe's limitation, not a passing semantic-quality gate. The `any` annotation
+exists only to make the lost type attribution explicit in this isolated fixture.
+
+The original six-fixture 7 November 2026 pilot passed in two cold processes with two
+passes each. All four normalized outputs matched SHA-256
+`ae1a6381c263289b5d006eda96cd73e87d1c9f5cbb95040fdb7c3e916d410bb9`.
+Pass times were 3492/3078 ms and 2880/2136 ms, excluding image/npm setup,
+container startup and coordinator work. These tiny-fixture timings establish
+neither repository-scale speed nor whole-review savings. The local raw archive
+is `~/.local/state/lekker-review-evaluation/runs/20261107-openrewrite-native`.
+The wrapper checks the package version; the retained lockfile pins transitive
+dependencies for that historical run. A fresh install may resolve different
+transitives and is a new experiment, not an exact historical replay.
+The expanded seven-fixture run also makes the forEach callback suspend before
+checking whether its work finished. Including the safe untyped receiver, it produced
+`52ba49e0a0fdc5a7fb0ad13574e04f11a102c19b029cf2e41d95bfab460e2613`.
+
+## Adoption limits
+
+This proves one recipe/version on synthetic fixtures, not population recall or
+false-positive rates. A false positive on a safe untyped receiver was observed;
+warnings need semantic verification. Preserve parse failures as unavailable.
+Printed markers/patches are evidence only; do not auto-apply them. The fixture
+runner is opt-in and intentionally absent from the normal dependency-free suite.
+
+The native package route worked without authentication; this does not prove
+every recipe works without Java/RPC or change the documented Moderne CLI's
+authentication requirements. The JavaScript package uses the Moderne Source
+Available License, distinct from Apache-licensed OpenRewrite core. No package
+redistribution or mandatory production integration is proposed here.
+
+References: [JavaScript development environment](https://docs.openrewrite.org/authoring-recipes/javascript-recipe-development-environment),
+[recipe testing example](https://docs.openrewrite.org/authoring-recipes/writing-a-javascript-refactoring-recipe),
+and [licensing](https://docs.openrewrite.org/licensing/openrewrite-licensing).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@olegkoval/agent-skills",
-  "version": "1.77.0",
+  "version": "1.78.1",
   "private": false,
   "publishConfig": {
     "access": "public"

package/plugins/olko-apple-kit/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-apple-kit",
   "description": "Build and ship Apple platform apps: macOS menubar apps, App Store submissions.",
-  "version": "1.77.0",
+  "version": "1.78.1",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-creative/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-creative",
   "description": "Creative and personal projects: photo galleries, music players, listings, wiki editing.",
-  "version": "1.77.0",
+  "version": "1.78.1",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-garmin-kit/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-garmin-kit",
   "description": "Build, test and publish Garmin Connect IQ watch faces.",
-  "version": "1.77.0",
+  "version": "1.78.1",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-git-tools/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-git-tools",
   "description": "Everyday git and GitHub CLI operations: conventional commits, branch hygiene.",
-  "version": "1.77.0",
+  "version": "1.78.1",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-github-pr/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-github-pr",
   "description": "Drive GitHub pull requests to merge-ready: review-bot loops, CI fixes, descriptions, dependency triage.",
-  "version": "1.77.0",
+  "version": "1.78.1",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-github-pr/skills/lekker-review/scripts/eval-runner.mjs

@@ -2,7 +2,7 @@
 // Score lekker findings against a manifest of PRs with known outcomes.
 //
 // Usage:
-//   node eval-runner.mjs --manifest evals/manifest.json --results <results.json> [--json]
+//   node eval-runner.mjs --manifest <manifest.json> (--results <results.json> | --archive <runs-dir>) [--json]
 //
 // manifest.json: { prs: [{ repo, pr, expect: "buggy"|"clean", knownBug?: "file:line + description", id?, sha? }] }
 //                The case key is `id` when present, else "<repo>#<pr>@<sha>" when `sha` is
@@ -21,6 +21,7 @@
 // verdict-affecting finding (critical or important) is a false positive.
 
 import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 export const LINE_WINDOW = 10;
@@ -74,6 +75,7 @@ export function validateManifest(manifest) {
   return prs;
 }
 
+/** Normalize archived review evidence, returning findings only when every identity check passes. */
 export function normalizeArchivedEvidence(entry, run, worktree, document) {
   const key = caseKey(entry);
   const unscored = (reason) => ({ key, reason });
@@ -98,6 +100,7 @@ export function normalizeArchivedEvidence(entry, run, worktree, document) {
 }
 
 // Validate archive references before reading any run directories.
+/** Reject duplicate archive run IDs before archive paths are read. */
 export function validateArchiveRunIds(entries) {
   const duplicate = entries.find((entry, index) => entry.runId
     && entries.slice(0, index).some(previous => previous.runId === entry.runId));
@@ -105,6 +108,30 @@ export function validateArchiveRunIds(entries) {
   return entries;
 }
 
+function readArchiveJson(path) {
+  try { return JSON.parse(readFileSync(path, 'utf8')); } catch { return null; }
+}
+
+/** Load valid archived findings and retain a reason for each rejected run. */
+function archivedResults(entries, runsDir) {
+  const results = {};
+  const reasons = [];
+  for (const entry of entries) {
+    if (typeof entry.runId !== 'string' || !RUN_ID.test(entry.runId)) {
+      reasons.push({ key: caseKey(entry), reason: 'unsafe or missing runId' });
+      continue;
+    }
+    const dir = join(runsDir, entry.runId);
+    const evidence = normalizeArchivedEvidence(entry,
+      readArchiveJson(join(dir, 'run.json')),
+      readArchiveJson(join(dir, 'worktree.json')),
+      readArchiveJson(join(dir, 'findings.json')));
+    if (evidence.reason) reasons.push({ key: evidence.key, reason: evidence.reason });
+    else results[evidence.key] = evidence.findings;
+  }
+  return { results, reasons };
+}
+
 export function score(manifest, results) {
   const rows = validateManifest(manifest).map((e) => {
     const key = caseKey(e);
@@ -147,12 +174,24 @@ export function score(manifest, results) {
 
 function main(argv) {
   const flag = (n) => { const i = argv.indexOf('--' + n); return i === -1 ? null : argv[i + 1]; };
-  if (!flag('manifest') || !flag('results')) {
-    console.error('usage: eval-runner.mjs --manifest <manifest.json> --results <results.json> [--json]');
+  const results = flag('results');
+  const archiveIndex = argv.indexOf('--archive');
+  const archive = archiveIndex === -1 ? null : argv[archiveIndex + 1];
+  const resultsIndex = argv.indexOf('--results');
+  if (!flag('manifest') || (archiveIndex !== -1 && (!archive || archive.startsWith('--')))
+      || (resultsIndex !== -1 && (!results || results.startsWith('--')))
+      || Boolean(results) === Boolean(archive)) {
+    console.error('usage: eval-runner.mjs --manifest <manifest.json> (--results <results.json> | --archive <runs-dir>) [--json]');
     process.exit(2);
   }
-  const out = score(JSON.parse(readFileSync(flag('manifest'), 'utf8')), JSON.parse(readFileSync(flag('results'), 'utf8')));
+  const manifest = JSON.parse(readFileSync(flag('manifest'), 'utf8'));
+  const source = archive
+    ? archivedResults(validateArchiveRunIds(validateManifest(manifest)), archive)
+    : { results: JSON.parse(readFileSync(results, 'utf8')), reasons: null };
+  const out = score(manifest, source.results);
+  if (source.reasons) out.unscoredReasons = source.reasons;
   if (argv.includes('--json')) { console.log(JSON.stringify(out)); return; }
+  for (const { key, reason } of source.reasons || []) console.error(`unscored ${key}: ${reason}`);
   const pct = (x) => (x === null ? 'n/a' : `${Math.round(x * 100)}%`);
   if (out.buggyRuns === undefined) {
     console.log(`recall ${pct(out.recall)} (${out.buggyScored} buggy scored), false positives ${out.falsePositives} (${out.cleanScored} clean scored), unscored ${out.unscored.length}`);

package/plugins/olko-github-pr/skills/lekker-review/scripts/evidence-bundle.mjs

@@ -0,0 +1,39 @@
+#!/usr/bin/env node
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { collectGitEvidence } from './git-evidence.mjs';
+import { validateLintReceipt } from './validate-lint-receipt.mjs';
+
+const record = value => value && typeof value === 'object' && !Array.isArray(value);
+const unavailableLint = reason => ({ captureStatus: 'unavailable', reason });
+const unavailableBundle = reason => ({ schema: 1,
+  git: { schema: 1, status: 'unavailable', reason }, lint: unavailableLint(reason) });
+
+export function collectEvidence(worktreeMetadata) {
+  if (!record(worktreeMetadata)) return unavailableBundle('worktree metadata is missing or malformed');
+  const git = collectGitEvidence({ worktreePath: worktreeMetadata.worktreePath,
+    mergeBase: worktreeMetadata.mergeBase, headSha: worktreeMetadata.headSha });
+  if (git.status !== 'available') return { schema: 1, git, lint: unavailableLint(`Git evidence unavailable: ${git.reason}`) };
+  if (typeof worktreeMetadata.eslintJson !== 'string' || !worktreeMetadata.eslintJson) return { schema: 1, git, lint: unavailableLint('lint report path unavailable') };
+  if (typeof worktreeMetadata.eslintProvenance !== 'string' || !worktreeMetadata.eslintProvenance) return { schema: 1, git, lint: unavailableLint('lint provenance path unavailable') };
+  let reportBytes, receipt;
+  try { reportBytes = readFileSync(worktreeMetadata.eslintJson); } catch { return { schema: 1, git, lint: unavailableLint('lint report could not be read') }; }
+  try { receipt = JSON.parse(readFileSync(worktreeMetadata.eslintProvenance, 'utf8')); } catch { return { schema: 1, git, lint: unavailableLint('lint provenance is missing or malformed') }; }
+  const provenance = validateLintReceipt(receipt, { baseSha: git.provenance.baseSha,
+    headSha: git.provenance.headSha, trackedClean: git.provenance.trackedCleanBefore && git.provenance.trackedCleanAfter }, reportBytes);
+  if (provenance.status !== 'available') return { schema: 1, git, lint: unavailableLint(provenance.reason) };
+  let report;
+  try { report = JSON.parse(reportBytes.toString('utf8')); } catch { return { schema: 1, git, lint: unavailableLint('lint report is malformed JSON') }; }
+  if (!Array.isArray(report)) return { schema: 1, git, lint: unavailableLint('lint report is not a JSON array') };
+  return { schema: 1, git, lint: { captureStatus: 'available', exitCode: provenance.exitCode,
+    reportSha256: provenance.reportSha256, report } };
+}
+
+function main(argv) {
+  const i = argv.indexOf('--worktree'), path = i < 0 ? null : argv[i + 1];
+  if (!path || path.startsWith('--')) { console.error('usage: evidence-bundle.mjs --worktree <worktree.json>'); process.exitCode = 2; return; }
+  try { console.log(JSON.stringify(collectEvidence(JSON.parse(readFileSync(path, 'utf8'))))); }
+  catch { console.log(JSON.stringify(unavailableBundle('worktree metadata could not be read'))); process.exitCode = 2; }
+}
+
+if (process.argv[1] === fileURLToPath(import.meta.url)) main(process.argv.slice(2));

package/plugins/olko-github-pr/skills/lekker-review/scripts/native-completion.mjs

@@ -0,0 +1,39 @@
+import { createHash } from 'node:crypto';
+
+const DIMENSIONS = {
+  deps: ['deps'],
+  scan: ['triage-quality', 'triage-logic', 'project-rules'],
+  medium: ['quality', 'implementation', 'simplification', 'conventions', 'test-quality', 'project-rules'],
+  deep: ['quality', 'implementation', 'simplification', 'conventions', 'test-quality', 'project-rules'],
+};
+const SHA = /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/i;
+const HASH = /^[a-f0-9]{64}$/i;
+const record = value => value && typeof value === 'object' && !Array.isArray(value);
+const count = value => Number.isSafeInteger(value) && value >= 0;
+
+/** Validate a native completion receipt against run policy and exact findings bytes. */
+export function validateNativeCompletion(receipt, expected, findingsBytes) {
+  const unavailable = reason => ({ available: false, reason });
+  if (!record(expected) || !record(expected.eligible) || !record(receipt)) return unavailable('receipt or expected inputs are malformed');
+  if (!['deps', 'scan', 'medium', 'deep'].includes(expected.depth) || typeof expected.worktreeAvailable !== 'boolean'
+      || !count(expected.eligible.verify) || !count(expected.eligible.prove)) return unavailable('expected policy inputs are malformed');
+  if (typeof expected.runId !== 'string' || !expected.runId || typeof expected.headSha !== 'string' || !SHA.test(expected.headSha)) return unavailable('expected identity is malformed');
+  if (!(findingsBytes instanceof Uint8Array)) return unavailable('findings bytes are unavailable');
+  if (receipt.schema !== 1 || receipt.engine !== 'codex' || receipt.status !== 'complete') return unavailable('native completion is not complete');
+  if (receipt.runId !== expected.runId || receipt.depth !== expected.depth) return unavailable('run identity or depth mismatch');
+  if (typeof receipt.headSha !== 'string' || !SHA.test(receipt.headSha) || receipt.headSha.toLowerCase() !== expected.headSha.toLowerCase()) return unavailable('head SHA mismatch');
+  if (typeof receipt.findingsSha256 !== 'string' || !HASH.test(receipt.findingsSha256)
+      || createHash('sha256').update(findingsBytes).digest('hex') !== receipt.findingsSha256.toLowerCase()) return unavailable('findings hash mismatch');
+  const required = DIMENSIONS[expected.depth];
+  if (!Array.isArray(receipt.dimensions) || receipt.dimensions.length !== required.length) return unavailable('required review dimensions are missing or duplicated');
+  const dimensions = Array.from(receipt.dimensions);
+  if (dimensions.some(d => !record(d) || !required.includes(d.name) || d.status !== 'completed')) return unavailable('review dimensions are missing, unknown, or incomplete');
+  if (new Set(dimensions.map(d => d.name)).size !== required.length) return unavailable('review dimensions are duplicated');
+  const verify = expected.depth === 'deps' ? 0 : expected.eligible.verify;
+  const prove = ['medium', 'deep'].includes(expected.depth) && expected.worktreeAvailable ? Math.min(5, expected.eligible.prove) : 0;
+  const validStage = (stage, scheduled) => record(stage) && count(stage.scheduled) && count(stage.completed)
+    && count(stage.failed) && stage.scheduled === scheduled && stage.completed === scheduled && stage.failed === 0;
+  if (!record(receipt.stages) || !validStage(receipt.stages.verify, verify) || !validStage(receipt.stages.prove, prove)) return unavailable('verification or proof stage accounting is incomplete');
+  if (receipt.stages.critic !== (expected.depth === 'deep' ? 'completed' : 'not_required')) return unavailable('critic stage status does not match depth');
+  return { available: true, reason: null };
+}

package/plugins/olko-obsidian/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-obsidian",
   "description": "Keep an Obsidian vault in sync with work: PR sync, task rollover, morning routine.",
-  "version": "1.77.0",
+  "version": "1.78.1",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-product/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-product",
   "description": "Take a product idea to a shippable build: MVP passes, full-stack scaffolds, UX/UI quality loops, launch plans.",
-  "version": "1.77.0",
+  "version": "1.78.1",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-reflection/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-reflection",
   "description": "Look back and improve: self-critique, retrospectives, performance review, rapid learning.",
-  "version": "1.77.0",
+  "version": "1.78.1",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-release/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-release",
   "description": "Ship a release: semantic-release setup, changelogs, store listing copy, release-day routine.",
-  "version": "1.77.0",
+  "version": "1.78.1",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-skill-meta/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-skill-meta",
   "description": "Author and maintain agent skills and the AI toolchain itself.",
-  "version": "1.77.0",
+  "version": "1.78.1",
   "author": {
     "name": "Oleg Koval"
   },

package/plugins/olko-web-ops/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "olko-web-ops",
   "description": "Operate a website: WAF rules, search console audits, analytics bootstrap, docs indexes.",
-  "version": "1.77.0",
+  "version": "1.78.1",
   "author": {
     "name": "Oleg Koval"
   },