@openora/create 0.4.1-canary.31 → 0.4.1-canary.310

package/template/tools/sync-agents.mjs

@@ -0,0 +1,257 @@
+#!/usr/bin/env node
+// Render the template-owned agent files from `@openora/create`'s consumer template.
+//
+// Source of truth: node_modules/@openora/create/template at the pinned @openora/* version
+// (with `pnpm link:oss`, ../openora/packages/create-openora's own tools/templates/consumer).
+// Runs on `pnpm install` via `prepare`, so these files are generated artifacts: they are
+// listed in the managed .gitignore block below and never committed. Only this repo's own
+// rules and skills - and the `consumerOwned` overrides in .rulesync/sync.json - are tracked.
+//
+// To change a synced file, edit openora's tools/templates/consumer and take the next bump.
+import {
+  existsSync,
+  mkdirSync,
+  readdirSync,
+  readFileSync,
+  realpathSync,
+  rmdirSync,
+  statSync,
+  unlinkSync,
+  writeFileSync,
+} from 'node:fs';
+import { execFileSync } from 'node:child_process';
+import { createRequire } from 'node:module';
+import { dirname, join, relative, sep } from 'node:path';
+
+const ROOT = process.cwd();
+const SYNCED_ROOTS = [
+  '.rulesync/',
+  'docs/standards/',
+  'docs/agents/',
+  'tools/sync-agents.mjs',
+  'tools/oss-worktree.mjs',
+  'tools/review-precheck.mjs',
+];
+// This script bootstraps `prepare`, so it must stay tracked: ignoring it would leave a
+// fresh clone with no way to run the install that would have rendered it.
+// Tracked on purpose: `prepare` runs the script, and the Claude hooks in .claude/settings.json
+// import _shared.mjs, so both must exist in a fresh clone before the first install.
+const NEVER_IGNORED = new Set(['tools/sync-agents.mjs', '.rulesync/hooks/_shared.mjs']);
+const SKIPPED_BASENAMES = new Set();
+// Dropped before the manifest below existed. The first install after the bump runs the previous,
+// tracked copy of this script, which overwrites itself and the .gitignore block but deletes
+// nothing, so the next run has no record of these.
+const RETIRED = [
+  '.rulesync/skills/add-feature/SKILL.md',
+  '.rulesync/skills/add-feature/handoff.md',
+  '.rulesync/subagents/qa.md',
+];
+
+const die = (message) => {
+  console.error(`sync:agents - ${message}`);
+  process.exit(1);
+};
+
+const config = (() => {
+  const path = join(ROOT, '.rulesync/sync.json');
+  if (!existsSync(path)) {
+    die(`${path} is missing - it holds this repo's template variables and consumerOwned list.`);
+  }
+  try {
+    return JSON.parse(readFileSync(path, 'utf8'));
+  } catch (err) {
+    return die(`${path} is not valid JSON: ${err.message}`);
+  }
+})();
+const vars = config.vars ?? {};
+const consumerOwned = new Set(config.consumerOwned ?? []);
+
+// The published package ships `template/`; a linked source checkout (pnpm link:oss, CI's
+// unbuilt clone) only has the source at tools/templates/consumer - read that directly.
+const templateRoot = (() => {
+  let pkgDir;
+  try {
+    pkgDir = dirname(createRequire(join(ROOT, '/')).resolve('@openora/create/package.json'));
+  } catch {
+    return die('@openora/create is not installed - add it as a devDependency and reinstall.');
+  }
+  const candidates = [
+    join(pkgDir, 'template'),
+    join(pkgDir, '..', '..', 'tools', 'templates', 'consumer'),
+  ];
+  const found = candidates.find((dir) => existsSync(dir));
+  if (!found) {
+    return die(`consumer template not found at ${candidates.join(' or ')}`);
+  }
+  return found;
+})();
+
+const walk = (dir) =>
+  readdirSync(dir).flatMap((entry) => {
+    const full = join(dir, entry);
+    return statSync(full).isDirectory() ? walk(full) : [full];
+  });
+
+const undot = (segment) => (segment.startsWith('__dot__') ? `.${segment.slice(7)}` : segment);
+
+const gitTracked = (paths) => {
+  try {
+    return execFileSync('git', ['ls-files', '-z', '--', ...paths], {
+      cwd: ROOT,
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+    })
+      .split('\0')
+      .filter(Boolean);
+  } catch {
+    return [];
+  }
+};
+
+const substitute = (content) =>
+  content.replace(/\{\{(\w+)\}\}/g, (match, key) => vars[key] ?? match);
+
+const render = (file) => {
+  const rel = relative(templateRoot, file).split(sep).map(undot).join('/');
+  const isTpl = rel.endsWith('.tpl');
+  const raw = readFileSync(file, 'utf8');
+  return { path: isTpl ? rel.slice(0, -4) : rel, content: isTpl ? substitute(raw) : raw };
+};
+
+const rendered = walk(templateRoot)
+  .filter((file) => !SKIPPED_BASENAMES.has(file.split(sep).at(-1)))
+  .map(render)
+  .filter(({ path }) => SYNCED_ROOTS.some((root) => path.startsWith(root)))
+  .filter(({ path }) => !consumerOwned.has(path));
+
+// A new template variable must not brick `pnpm install` (which is also how the bump MR that
+// would add it gets built) - leave the placeholder in place and say what to add.
+const unresolved = rendered.filter(({ content }) => /\{\{\w+\}\}/.test(content));
+if (unresolved.length > 0) {
+  console.warn(
+    'sync:agents - unresolved template variables, add them to .rulesync/sync.json vars:',
+  );
+  for (const { path, content } of unresolved) {
+    console.warn(`  ${path}: ${[...new Set(content.match(/\{\{\w+\}\}/g))].join(' ')}`);
+  }
+}
+
+// Tracking a path is how this repo says "mine": .gitignore does not apply to it, so writing
+// would replace the committed content and leave a permanently dirty file. Skip those and
+// name them - opting one into being generated is a deliberate `git rm --cached`.
+const trackedPaths = new Set(gitTracked(rendered.map(({ path }) => path)));
+const owned = rendered.filter(({ path }) => trackedPaths.has(path) && !NEVER_IGNORED.has(path));
+
+for (const { path, content } of rendered) {
+  if (trackedPaths.has(path) && !NEVER_IGNORED.has(path)) {
+    continue;
+  }
+  const target = join(ROOT, path);
+  mkdirSync(dirname(target), { recursive: true });
+  if (!existsSync(target) || readFileSync(target, 'utf8') !== content) {
+    writeFileSync(target, content);
+  }
+}
+
+// Git must ignore exactly what this script writes, so a template that gains or loses a
+// file cannot leave an untracked stray behind. The block is rewritten in place; anything
+// outside the markers is left alone.
+const BEGIN = '# BEGIN synced-agents (generated by tools/sync-agents.mjs - do not edit)';
+const END = '# END synced-agents';
+const gitignore = join(ROOT, '.gitignore');
+// A tracked path is never ignored by git anyway - listing it would only mislead.
+const ignored = rendered.filter(({ path }) => !NEVER_IGNORED.has(path) && !trackedPaths.has(path));
+const block = [BEGIN, ...ignored.map(({ path }) => `/${path}`).sort(), END].join('\n');
+const current = existsSync(gitignore) ? readFileSync(gitignore, 'utf8') : '';
+const start = current.indexOf(BEGIN);
+// Search for END after BEGIN: a stray END earlier in the file (hand-edit, bad merge) would
+// otherwise splice at a negative offset and duplicate the whole block.
+const end = start === -1 ? -1 : current.indexOf(END, start + BEGIN.length);
+if (start !== -1 && end === -1) {
+  die(`${gitignore} has a ${BEGIN} marker with no matching ${END} - repair or delete the block.`);
+}
+// A file the template dropped or renamed is still on disk from the last render, untracked and
+// no longer ignored: delete what fell out of it. The old block lists what was rendered then,
+// but after a branch switch the committed block already names the new set, so the manifest
+// (outside git, per checkout) remembers what this checkout actually has on disk.
+const manifest = join(ROOT, 'node_modules/.cache/sync-agents.json');
+const lastRendered = (() => {
+  try {
+    const paths = JSON.parse(readFileSync(manifest, 'utf8'));
+    return Array.isArray(paths) ? paths.filter((path) => typeof path === 'string') : [];
+  } catch {
+    return [];
+  }
+})();
+const lastBlock =
+  start === -1
+    ? []
+    : current
+        .slice(start + BEGIN.length, end)
+        .split('\n')
+        .filter((line) => line.startsWith('/'))
+        .map((line) => line.slice(1));
+// The block and the manifest are plain text anyone can edit: a symlinked directory on the way
+// would point the delete outside the checkout, so every parent must resolve to itself.
+const realRoot = realpathSync(ROOT);
+const parentIsReal = (path) => {
+  try {
+    return realpathSync(dirname(join(ROOT, path))) === join(realRoot, dirname(path));
+  } catch {
+    return false;
+  }
+};
+const stale = [...new Set([...lastBlock, ...lastRendered, ...RETIRED])]
+  .filter((path) => SYNCED_ROOTS.some((root) => path.startsWith(root)) && !path.includes('..'))
+  .filter((path) => !ignored.some((file) => file.path === path) && !consumerOwned.has(path))
+  .filter(parentIsReal);
+// Never one this repo has since started tracking. (No paths: ls-files would list them all.)
+const staleTracked = new Set(stale.length > 0 ? gitTracked(stale) : []);
+for (const path of stale.filter((path) => !staleTracked.has(path))) {
+  const target = join(ROOT, path);
+  if (existsSync(target)) {
+    unlinkSync(target);
+    for (
+      let dir = dirname(target);
+      dir !== ROOT && readdirSync(dir).length === 0;
+      dir = dirname(dir)
+    ) {
+      rmdirSync(dir);
+    }
+  }
+}
+const updated =
+  start === -1
+    ? `${current.trimEnd()}\n\n${block}\n`.trimStart()
+    : current.slice(0, start) + block + current.slice(end + END.length);
+if (updated !== current) {
+  writeFileSync(gitignore, updated);
+}
+mkdirSync(dirname(manifest), { recursive: true });
+writeFileSync(manifest, JSON.stringify(ignored.map(({ path }) => path)));
+
+console.log(`sync:agents - ${rendered.length - owned.length} template-owned file(s) rendered.`);
+if (owned.length > 0) {
+  console.warn(
+    `  ${owned.length} kept as-is because this repo tracks them: ${owned.map(({ path }) => path).join(', ')}\n` +
+      `  To let the template own one, untrack it: git rm --cached <path>`,
+  );
+}
+
+// Both files are tracked by every consumer, so a template bump cannot wire the verify gate in.
+const missingWiring = [
+  ['.claude/settings.json', 'guard-mr.mjs', 'a PreToolUse "Bash" hook running guard-mr.mjs'],
+  [
+    'package.json',
+    'guard-mr.mjs --stamp',
+    'end "verify" with `&& node .rulesync/hooks/guard-mr.mjs --stamp`',
+  ],
+].filter(([path, marker]) => {
+  const target = join(ROOT, path);
+  return existsSync(target) && !readFileSync(target, 'utf8').includes(marker);
+});
+for (const [path, , fix] of missingWiring) {
+  console.warn(
+    `sync:agents - ${path} is missing the verify gate: ${fix} (see the template's copy).`,
+  );
+}

package/template/turbo/generators/config.ts

@@ -1,2 +1,2 @@
 // To customize, replace this re-export with your own plop config.
-export { default } from '@openora/turbo-generators';
+export { default } from '@openora/core/generators';

package/template/turbo.json

@@ -1,6 +1,7 @@
 {
   "$schema": "https://turbo.build/schema.json",
   "ui": "tui",
+  "globalDependencies": [".oxlintrc.json"],
   "tasks": {
     "build": {
       "dependsOn": ["^build"],
@@ -10,8 +11,19 @@
       "cache": false,
       "persistent": true
     },
-    "typecheck": {
-      "dependsOn": ["^build"]
+    "check:types": {
+      "dependsOn": ["^build"],
+      "outputs": []
+    },
+    "//#check:lint": {
+      "inputs": [
+        "**/*.{ts,tsx,mts,cts,js,mjs,cjs,jsx}",
+        "!.turbo/**",
+        "!**/node_modules/**",
+        "!**/dist/**",
+        "!**/.next/**"
+      ],
+      "outputs": []
     }
   }
 }

package/template/__dot__rulesync/hooks/post-edit.mjs

@@ -1,57 +0,0 @@
-#!/usr/bin/env node
-import { execSync } from 'node:child_process';
-import { readFileSync } from 'node:fs';
-import { join, isAbsolute, relative } from 'node:path';
-import { extractFilePath, readPayload } from './_shared.mjs';
-
-const CAP_LINES = 40;
-const CAP_CHARS = 2000;
-
-const filePath = extractFilePath(readPayload());
-if (!filePath) process.exit(0);
-if (!/\.(ts|tsx)$/.test(filePath) || /\.d\.ts$/.test(filePath)) process.exit(0);
-if (filePath.includes('/templates/') || filePath.includes('/generated/')) process.exit(0);
-
-// Lint-fix (best effort - never block on the linter).
-try {
-  execSync(`pnpm exec oxlint --fix "${filePath}"`, { stdio: 'pipe' });
-} catch {
-  /* oxlint unavailable or errored - fall through to typecheck */
-}
-
-function packageNameFor(fp) {
-  const m = fp.match(/(.*?\/(?:apps\/[^/]+|packages\/[^/]+\/[^/]+))\//);
-  if (!m) return null;
-  try {
-    const pkg = JSON.parse(readFileSync(join(m[1], 'package.json'), 'utf8'));
-    if (!pkg.name || !pkg.scripts?.typecheck) return null;
-    return pkg.name;
-  } catch {
-    return null;
-  }
-}
-
-const abs = isAbsolute(filePath) ? filePath : join(process.cwd(), filePath);
-const owner = packageNameFor(abs);
-if (!owner) process.exit(0);
-
-function cap(text) {
-  const out = text.split('\n').slice(0, CAP_LINES).join('\n').slice(0, CAP_CHARS);
-  return out.length < text.length ? `${out}\n... (truncated)` : out;
-}
-
-try {
-  execSync(`pnpm --filter "${owner}" typecheck`, { stdio: 'pipe' });
-  process.exit(0);
-} catch (e) {
-  const output = (e.stdout?.toString() ?? '') + (e.stderr?.toString() ?? '');
-  const basename =
-    (isAbsolute(filePath) ? relative(process.cwd(), filePath) : filePath).split('/').pop() ?? '';
-  if (basename && output.includes(basename)) {
-    process.stderr.write(
-      `Typecheck failed for ${owner} after editing ${basename}:\n${cap(output)}`,
-    );
-    process.exit(2);
-  }
-  process.exit(0);
-}

package/template/__dot__rulesync/skills/add-feature/SKILL.md

@@ -1,113 +0,0 @@
----
-name: add-feature
-
-description: >
-  Deliver a feature end-to-end in this consumer repo. Aggregates context (Jira + Confluence + Slack +
-  Google Drive + Notion + local docs + past sessions + codebase), produces an approved plan, then drives
-  delivery by calling sibling skills - create-plugin (build), code-review (review), create-pr (MR) -
-  and create-task for ticket hygiene. Transitions Jira (no comments) and drafts a one-line Slack
-  notice. Use on "add feature", "plan <KEY>-XXX", "deliver <KEY>-XXX", or /add-feature [<KEY>-XXX].
-  Read-only until the plan is approved; never pushes, transitions Jira, or sends Slack without OK.
----
-
-# add-feature
-
-Feature-delivery orchestrator for this consumer repo: one Jira key in, a delivered MR +
-updated ticket + drafted Slack notice out. You orchestrate and call sibling skills - you do not
-re-implement their work. The platform-core twin is the `/add-feature` skill in the platform OSS repo.
-
-## Coordinates
-
-- Jira: the **Atlassian** MCP, cloudId `<your-jira-cloud-id>`,
-  project `<your-project-key>` (ticket keys look like `<KEY>-XXX`). Pass `contentFormat` +
-  `responseContentFormat: "markdown"`.
-- GitLab: `<your-gitlab-project>`, MR target `dev`, `glab` CLI.
-- Slack: `<your-team-channel>`, draft only.
-- Repo: `apps/api` (Hono entry + extensions) consumes `@openora/*` upstream. This is a headless
-  API consumer; build your frontend in its own repo and consume the API over HTTP.
-- **Hard rule:** the linked OSS checkout is read-only (guard-core hook + permission deny). Extend from
-  the outside; core changes hand off - see `handoff.md`.
-
-## The contract
-
-- **Read-only until the Step 3 plan is approved.** No edits, commits, pushes, Jira writes, or Slack
-  sends before sign-off.
-- Reuse sibling skills, don't reinvent: **create-task** (ticket format), **create-plugin** (build an
-  overlay), **code-review** (review), **create-pr** (MR). Delegate code to subagents.
-
-## Steps
-
-### 1. Resolve input + enhance the ask
-
-`<KEY>-XXX` from `$ARGUMENTS`; if absent, ask. Echo it back. Run the `enhance-prompt` pre-step on the ask before gathering context, so Step 2 pulls only what's relevant and Step 3 plans against a clear brief.
-
-### 2. Gather context in parallel (read-only)
-
-Run together; skip any source that returns nothing. Read `handoff.md` only on core-change signals.
-
-| Source        | How                                                                                             |
-| ------------- | ----------------------------------------------------------------------------------------------- |
-| Jira          | the **Atlassian** MCP - read `<KEY>-XXX`: description, AC, comments, parent epic, linked issues |
-| Confluence    | the **Atlassian** (Confluence) MCP - search the space + read pages                              |
-| Slack         | the **Slack** MCP - search public/private, read threads, read canvases                          |
-| Google Drive  | the **Google Drive** MCP - PRDs, specs                                                          |
-| Notion        | `ntn` CLI per `notion-memory` skill - prior decisions, lessons                                  |
-| Local docs    | the OSS checkout's `docs` (ADRs, `architecture.md`, `catalog.json`), repo READMEs, `CLAUDE.md`  |
-| Past sessions | grep `~/.claude/projects/**` and `~/.claude/plans` for the ticket key                           |
-| Codebase      | `oss` MCP (read-only) + Explore - map touchpoints in `apps/api`                                 |
-
-### 3. Plan + classify (the gate)
-
-Synthesize into a plan and present it. Do NOT edit yet.
-
-- **Goal** (1-2 lines) + **Acceptance criteria** (observable, testable).
-- **Decisions found** - each with source (who/where/date), so they aren't relitigated.
-- **Open questions** - ask before proceeding if any blocks design.
-- **Implementation breakdown** - tasks mapped to files/packages + the owning subagent. Classify each:
-  - **downstream** -> overlay plugin / adapter swap / UI provider / config (build via `create-plugin`).
-  - **OSS-core** -> only fixable in `@openora/*`. Flag it; triggers `handoff.md`.
-- **Risks / dependencies** - external services, OSS handoff, data/migrations.
-
-Require explicit approval. Treat as plan mode even if the harness isn't.
-
-### 4. Build (delegate)
-
-After approval, for **downstream** work: run the **create-plugin** skill for each overlay/adapter/
-page slice - it scaffolds, wires `extensions.config.ts`, and enforces boundaries + audit + db rules.
-The owning subagent (`builder`) also writes unit + integration tests as part of the deliverable.
-`deployer` only if infra changes; `debugger` on demand for build/runtime failures.
-
-For **OSS-core** items: read `handoff.md`, write the work-order, STOP that slice, continue the rest.
-When implementation starts, transition Jira to In Progress (Step 7 - confirm first).
-
-### 5. Review + tests
-
-- Run **code-review** on the change set; loop `[BLOCK]`/`[WARN]` fixes back through `builder`.
-- Run `/check` (typecheck + lint). Don't proceed on red.
-- Derive an e2e checklist from the AC (happy path, edge cases, authz negatives, error states), then
-  `qa`: write/run the E2E specs, drive `chrome-devtools` on failure.
-
-### 6. Open the MR
-
-Run **create-pr**: it commits (`feat(<KEY>-XXX): ...`), reports the SHA, asks for "yes push", pushes,
-and `glab mr create`s targeting `dev` with the CODEOWNERS for the changed paths as reviewers. Don't
-bypass its push-consent gate.
-
-### 7. Jira status transition (NOT comments)
-
-Use the **Atlassian** MCP - fetch the transitions -> show current status + options -> **confirm** ->
-apply the matching one (In Progress when build starts, In Review when the MR opens). **No MR-link or status comments.**
-
-### 8. Draft Slack notice (one line)
-
-Use the **Slack** MCP to draft a message to `<your-team-channel>`: a single line - emoji + PR/task name
-as a link (e.g. `👉 <feature> - MR !NN`). **Draft only**, never direct-send.
-
-## Rules
-
-- Read-only until the Step 3 plan is approved.
-- Never push without an explicit per-action "yes push" (inherited from `create-pr`).
-- Never transition Jira without confirming; show status + options first. No Jira comments.
-- Slack is a one-line draft, never direct-send.
-- Never edit the linked OSS checkout; hand off via `handoff.md`. Prefer overlay/plugin/adapter/config.
-- One MR = one concern. Split unrelated work.

package/template/__dot__rulesync/skills/add-feature/handoff.md

@@ -1,58 +0,0 @@
-# OSS core handoff
-
-When an `add-feature` work item can only be fixed in `@openora/*` core, this consumer repo cannot
-edit it (the `guard-core.mjs` hook and `permissions.deny` block the linked OSS checkout). Hand off to
-the platform-core twin skill instead of fighting the guard.
-
-## When to hand off
-
-- The fix requires changing a contract, schema, service, router, or platform seam in `@openora/*`.
-- An overlay plugin / adapter swap / UI provider override / config change genuinely cannot
-  express the behavior.
-- Default bias: try to extend from the outside first. Only hand off when you've confirmed the
-  outside-in path doesn't exist.
-
-If you're unsure, say so in the plan (Step 3) and let the user decide before writing the order.
-
-## Work-order template
-
-Write to `~/.claude/plans/<ticket-key>-oss.md` so both repos and future sessions can read it:
-
-```markdown
-# OSS work order - <ticket-key>: <title>
-
-## Goal
-
-<what core must do, 1-2 lines>
-
-## Unblocks
-
-consumer feature <ticket-key> - <which downstream slice depends on this>
-
-## Core surface to change
-
-- <package / module / contract / adapter token, as specific as possible>
-
-## Contract / schema impact
-
-- <new or changed oRPC contracts, Drizzle tables, events; or "none">
-
-## Acceptance
-
-- <observable outcomes that prove the core change is correct>
-
-## Dependency
-
-consumer MR <url-or-TBD> stays in draft until this merges and a new @openora/core/\* version is consumed.
-```
-
-## Protocol
-
-1. The consumer repo writes the work-order and **stops** that slice (keep delivering independent
-   downstream slices meanwhile).
-2. The user runs `/add-feature` inside the platform OSS repo (separate cwd/session). It reads
-   the work-order, implements, and opens its own MR there.
-3. The consumer MR stays draft/blocked until the OSS MR merges and the consumer bumps the consumed
-   `@openora/*` version. Link the two by the work-order path and the ticket key.
-4. Note the handoff in the Jira ticket and the consumer MR description so the dependency is
-   visible.

package/template/__dot__rulesync/skills/code-review/SKILL.md

@@ -1,111 +0,0 @@
----
-name: code-review
-description: Multi-agent code review of the working branch against this repo's conventions, OSS-core boundaries, security, and operator-domain fit. Fans out a configurable number of parallel reviewers, each grounded in the rule docs, then synthesizes one verdict. Use on "review this", "code review", "/code-review", optionally "--agents N", "--base <ref>", "--fix", a GitLab MR number, or paths.
----
-
-# code-review
-
-Orchestrate a parallel, convention-grounded code review of the current change set in this downstream
-igaming operator repo. You are the orchestrator: scope the diff, fan out N reviewers across review
-dimensions, dedup their findings, and report ONE verdict. Report-only by default - never edit unless
-`--fix` is passed.
-
-Copy this checklist and tick it off as you go:
-
-```
-code-review:
-- [ ] 1. Parse args (--agents / --base / MR# / paths / --fix)
-- [ ] 2. Scope the diff; if empty, ask
-- [ ] 3. Pick applicable dimensions (only those with touched files)
-- [ ] 4. Spawn reviewers in ONE message (parallel)
-- [ ] 5. Dedup + apply the evidence/confidence gate
-- [ ] 6. Report one verdict (+ apply fixes only if --fix)
-```
-
-## 1. Parse `$ARGUMENTS`
-
-| Token               | Meaning                                                         | Default                         |
-| ------------------- | --------------------------------------------------------------- | ------------------------------- |
-| `--agents N`        | how many parallel reviewers to spawn (1-5)                      | one per applicable dimension    |
-| `--base <ref>`      | branch to diff against                                          | `dev` (this repo's integration) |
-| `<number>` (e.g. 8) | a GitLab MR number - review that MR's diff (`glab mr diff <n>`) | -                               |
-| paths               | restrict review to these files/dirs                             | whole diff                      |
-| `--fix`             | apply fixes for `[BLOCK]`/`[WARN]` findings after the review    | off (report only)               |
-
-## 2. Scope the diff (do this first)
-
-- Branch: `git diff <base>...HEAD --name-only` (default base `dev`). If empty, fall back to
-  unstaged/staged via `git status -s`; if still empty, ask what to review.
-- MR number given: `glab mr diff <n>` for the patch + `glab mr view <n>` for intent.
-- Group changed files by app/package so reviewers and any file-split share the same map.
-
-## 3. Ground every reviewer (mandatory)
-
-Each spawned reviewer MUST read the actual changed code AND the rule docs that own its dimension
-before judging - do not infer behavior from a diff hunk. If a finding depends on what a called
-function does, open it; if you can't cite it, fetch it. These docs are the single source of truth -
-cite them in findings:
-
-- `.claude/rules/overview.md` - what this repo is (a downstream operator on `@openora/*` consumed as linked packages), the HARD RULE that OSS core is read-only, how you work here, and the enforced import/module boundaries (extend only from the outside).
-- `.claude/rules/db-conventions.md` - SQL / Drizzle rules for tables an overlay owns.
-- Any other `.claude/rules/*.md` the consumer has added (e.g. `conventions`, `oss-boundaries`, `frontend`) - cite whichever own the touched files.
-
-## 4. Review dimensions
-
-Each dimension maps to a rule doc and, where one fits, a pre-scoped subagent. Spawn only the
-dimensions whose files actually changed.
-
-| #   | Dimension                  | Covers                                                                                                                              | Use subagent       |
-| --- | -------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- | ------------------ |
-| 1   | OSS boundaries & extension | never edits `@openora/*` core; extends only via `extensions.config.ts` / overlay plugins / vendor adapters; no deep `dist/` imports | general (overview) |
-| 2   | Conventions & quality      | naming, functional/immutable, no `any`/`interface`/default-export, types inferred not hand-written, comments WHY, tests             | general (overview) |
-| 3   | Frontend                   | React/styling rules - only if a frontend app or shared UI package was added and changed                                             | general (frontend) |
-| 4   | Security & secrets         | authz on overlay routes, vendor-adapter creds from env (KYC/PSP/notify), no secret/PII leaks, Zod-validated input                   | general (overview) |
-| 5   | Operator/domain fit        | does the change make igaming sense for this operator; launch-blockers (only if business logic changed)                              | `expert`           |
-
-## 5. Allocate reviewers to `--agents N`
-
-- `N` unset: one reviewer per applicable dimension (skip dimensions with no touched files).
-- `N` >= applicable dimensions: extra agents split the largest dimension by file group (state the split; never silently drop files).
-- `N` < applicable dimensions: merge adjacent dimensions into `N` buckets, preferring to keep 1 (OSS boundaries) and 4 (security) standalone.
-
-Spawn all reviewers in a SINGLE message (parallel `Task` calls). Use `general-purpose` for general
-dimensions with an explicit instruction to read the §3 docs first; use `expert` for the
-domain-fit dimension. Pass each reviewer: the changed-file list, the base ref, its dimension
-checklist, and the report-only constraint.
-
-## 6. Evidence & confidence gate (cut false positives)
-
-Tell every reviewer to apply this before returning, and re-apply it yourself when synthesizing:
-
-- Every `[BLOCK]` and `[WARN]` MUST cite a concrete `file:line` AND the rule doc it violates. No location or no rule = downgrade to `[INFO]` or drop it.
-- Report only high-confidence findings. If unsure whether something is a real defect vs a theoretical nit, downgrade or omit - prefer few actionable findings over flooding.
-- Don't invent runtime failures you haven't traced through the code. State the trigger path or don't raise it.
-- Don't bikeshed and don't duplicate what tooling already enforces: oxlint and the `/check` gate (`pnpm typecheck`, `pnpm lint`). For a suspected lint/boundary issue, say "confirm with `pnpm lint`" rather than guessing - flag only what those gates miss.
-- Each reviewer self-checks before returning: every finding has evidence + a cited rule, uncertain claims downgraded, no style nitpicks lint already catches, no unverified runtime claims.
-
-## 7. Synthesize
-
-Collect all findings, dedup by `file:line`, and merge into one report. Each finding:
-
-- `[BLOCK]` - must fix before merge (edits OSS core, boundary break, authz/secret/PII risk, broken extension wiring).
-- `[WARN]` - should fix (convention violation, missing test, weak input validation).
-- `[INFO]` - FYI / hardening.
-
-Group by dimension, ordered BLOCK -> WARN -> INFO. Each line:
-`[SEV] file:line - finding - evidence - rule cited - fix`. BLOCK/WARN without a `file:line` and a
-cited rule do not ship - they were already dropped by the gate in §6. Lead with a one-line summary:
-counts per severity + verdict. End with **APPROVED** / **CHANGES REQUESTED** and the single most
-critical finding.
-
-If `--fix`: after the report, apply BLOCK + WARN fixes in the working tree (smallest diff that
-satisfies the cited rule), then run the `/check` gate (`pnpm typecheck && pnpm lint`)
-and report green/red. Leave INFO items untouched. Never commit or push.
-
-## Constraints
-
-- Read-only by default; `--fix` edits the working tree only - no commit, no push.
-- NEVER edit `@openora/*` core or `node_modules` - this repo extends the platform from the outside only.
-- Reviewers report findings; they do not edit. Only the orchestrator edits, and only under `--fix`.
-- Always cite the rule doc a finding rests on - no opinions ungrounded in the conventions.
-- Cap at 5 parallel reviewers.