@rune-kit/rune 2.18.1 → 2.20.0

package/skills/onboard/SKILL.md

@@ -306,6 +306,49 @@ Suggest switching to interview mode (but don't force it) when:
 
 Output: `"ℹ️ This project is hard to auto-detect. Run /rune onboard --interview for guided setup."`
 
+### Step 6f — Emit comprehension.json
+
+Write `.rune/comprehension.json` conforming to `compiler/schemas/comprehension.schema.json`.
+This is ADDITIVE — do not touch any of the Markdown files created above.
+
+Populate from the scan data already collected in Steps 2–3:
+
+```json
+{
+  "project": "<project name from Step 2>",
+  "generated_at": "<ISO 8601 timestamp>",
+  "source": "onboard",
+  "health_score": null,
+  "layers": [
+    { "id": "api", "name": "API / Routes", "color": "service" },
+    { "id": "service", "name": "Business Logic", "color": "service" },
+    { "id": "data", "name": "Data / Storage", "color": "data" },
+    { "id": "ui", "name": "UI / Views", "color": "code" },
+    { "id": "util", "name": "Utilities", "color": "code" }
+  ],
+  "domains": [],
+  "modules": [
+    {
+      "id": "<relative file path or module id>",
+      "name": "<file or module name>",
+      "layer": "<id from layers — best-guess from file path>",
+      "type": "file",
+      "complexity": "simple",
+      "files": 1,
+      "summary": "<one-line description>"
+    }
+  ],
+  "edges": []
+}
+```
+
+Rules:
+- `modules[]` — include only the entry points and config files read in Steps 1–3 (5–15 items max). Do not enumerate all project files.
+- `layers[]` — include only layers actually detected; omit unused ones.
+- `edges[]` — leave empty; onboard does not trace cross-file dependencies.
+- `health_score` — set to null; health scoring requires autopsy.
+- If `.rune/comprehension.json` already exists, overwrite it (generated output, not human-written).
+
 ### Step 7 — Commit
 Use `Bash` to stage and commit the generated files:
 ```bash
@@ -413,6 +456,7 @@ Known failure modes for this skill. Check these before declaring done.
 - .rune/ directory initialized with conventions, decisions, progress, session-log, instincts
 - .rune/DEVELOPER-GUIDE.md written with setup commands from actual scan
 - All generated commands verified to exist in package.json/Makefile/etc.
+- .rune/comprehension.json written conforming to comprehension.schema.json (project, generated_at, source:"onboard", modules[], edges[])
 - Onboard Report emitted with Generated + Skipped + Observations sections
 
 ## Returns
@@ -424,6 +468,7 @@ Known failure modes for this skill. Check these before declaring done.
 | Decision log (initialized) | Markdown | `.rune/decisions.md` |
 | Developer onboarding guide | Markdown | `.rune/DEVELOPER-GUIDE.md` |
 | Session/progress files | Markdown | `.rune/progress.md`, `.rune/session-log.md` |
+| Comprehension graph | JSON | `.rune/comprehension.json` |
 
 ## Cost Profile
 

package/skills/perf/SKILL.md

@@ -3,7 +3,7 @@ name: perf
 description: "Performance regression gate. Detects N+1 queries, sync-in-async, missing indexes, memory leaks, and bundle bloat before they reach production. Ranks findings by Cost Impact Hierarchy (architecture > data transfer > compute > DB > caching) so fix priority maps to actual unit-cost reduction."
 metadata:
   author: runedev
-  version: "0.4.0"
+  version: "0.5.0"
   layer: L2
   model: sonnet
   group: quality
@@ -43,6 +43,9 @@ Performance regression gate. Analyzes code changes for patterns that cause measu
 
 - `references/cost-reference.md` — Cost priority hierarchy, quick wins checklist, instance right-sizing, data transfer traps, serverless optimization, observability cost control, managed vs self-hosted matrix, unit economics tracking. Load when cost analysis or FinOps context detected.
 - `references/scalability-reference.md` — Bottleneck identification flow, performance thresholds, API patterns (cursor pagination, rate limiting, circuit breaker, graceful shutdown), caching strategies, queue-based load leveling, concurrency patterns, K8s HPA, CDN headers, load testing. Load when scaling or infrastructure optimization context detected.
+- `../deploy/references/observability.md` — Instrumentation discipline (RED/USE metrics, percentiles-not-averages, cardinality bounds, structured logs, correlation IDs). Load when establishing the *measurement basis* for an optimization — you cannot optimize what you do not measure.
+
+**Measure before optimizing.** A perf finding without a metric behind it is a guess. Before recommending a fix, confirm the hotpath actually emits the signal that proves it is slow: RED latency as a **histogram** (read p95/p99 — averages hide the slow tail), bounded label cardinality, and a correlation ID to tie a slow trace to its logs. If the instrumentation does not exist yet, that absence is itself a finding (`UNMEASURED_HOTPATH`). See `../deploy/references/observability.md` for the instrumentation contract.
 
 ## Executable Steps
 

package/skills/review/SKILL.md

@@ -3,7 +3,7 @@ name: review
 description: "Code quality review — patterns, security, performance, correctness. Finds bugs, suggests improvements, triggers fix for issues found. Escalates to opus for security-critical code."
 metadata:
   author: runedev
-  version: "1.1.0"
+  version: "1.2.0"
   layer: L2
   model: sonnet
   group: development
@@ -181,6 +181,8 @@ Check for security-relevant issues.
 - If any security-sensitive code found (auth logic, input handling, crypto, payment): call `rune:sentinel` for deep scan
 - Sentinel escalation is mandatory — do not skip it for auth or crypto code
 
+**Optional cross-model second opinion** (security-critical / opus-escalated reviews only): a same-family reviewer shares blind spots with the author. For genuinely irreversible or attacker-facing changes (auth, crypto, payment, data migration), you MAY *offer* the user a different-architecture second pass via an external CLI (Gemini/Codex). This is opt-in and interactive-only — **offer, never auto-invoke**; skip in non-interactive runs (CI, `/loop`, scheduled) and announce the skip. If the user accepts, follow the safe transport in `../adversary/references/cross-model-escalation.md` (per-call authorization, read-only sandbox, stdin not inline args), pass the diff + the security contract (not your verdict), and reconcile the reply as data — not a ruling.
+
 ### Step 4.5: API Pit-of-Success Check
 
 For code that exposes APIs, shared utilities, or reusable interfaces, evaluate through 3 adversary personas:
@@ -619,7 +621,7 @@ Append to Code Review Report when invoked standalone. Suppress when called as su
 ```yaml
 chain_metadata:
   skill: "rune:review"
-  version: "1.0.0"
+  version: "1.2.0"
   status: "[DONE | DONE_WITH_CONCERNS]"
   domain: "[area reviewed]"
   files_changed: []  # review doesn't change files