@rune-kit/rune 2.29.1 → 2.30.1

package/skills/audit/SKILL.md

@@ -5,7 +5,7 @@ metadata:
   author: runedev
   version: "0.5.0"
   layer: L2
-  model: sonnet
+  model: opus
   group: quality
   tools: "Read, Bash, Glob, Grep"
   emit: audit.complete
@@ -585,7 +585,7 @@ LOW      — Nice to have. Style inconsistencies, minor refactors, doc gaps.
 INFO     — Observation only. Architecture notes, tech debt acknowledgment.
 ```
 
-Apply confidence filtering: only report findings with >80% confidence. Consolidate similar issues (e.g., "12 functions missing error handling in src/services/" — not 12 separate findings). Adapt judgment to project type (a `console.log` in a CLI tool is fine; in a production API handler, it's not).
+Apply the Falsification Pass (`../review/SKILL.md` → Step 6): drop a finding only when what you read contains direct counter-evidence against its key claim — never merely because you are unsure. A finding you cannot disprove is reported and typed `ASSUMED` with the unchecked premise named. Consolidate similar issues (e.g., "12 functions missing error handling in src/services/" — not 12 separate findings). Adapt judgment to project type (a `console.log` in a CLI tool is fine; in a production API handler, it's not).
 
 ## Output Format
 
@@ -644,7 +644,7 @@ Report saved to: AUDIT-REPORT.md
 
 1. MUST complete all 8 phases (Phase 8 may report "no data" if .rune/metrics/ doesn't exist yet) — if any phase is skipped, state explicitly which phase and why
 2. MUST delegate Phase 1 to dependency-doctor and Phase 2 to sentinel — no manual replacements
-3. MUST apply confidence filter — only report findings with >80% confidence; consolidate similar issues
+3. MUST apply the Falsification Pass — drop findings only on direct counter-evidence, never on uncertainty; consolidate similar issues
 4. MUST include at least 3 positive findings — an audit with no positives is incomplete
 5. MUST produce quantified health scores (1-10 per dimension) — not vague "needs work"
 6. MUST NOT fabricate findings — every finding requires a specific file:line citation

package/skills/completion-gate/SKILL.md

@@ -6,7 +6,7 @@ metadata:
   author: runedev
   version: "1.10.0"
   layer: L3
-  model: haiku
+  model: sonnet
   group: validation
   tools: "Read, Bash, Glob, Grep"
 ---

package/skills/constraint-check/SKILL.md

@@ -6,7 +6,7 @@ metadata:
   author: runedev
   version: "1.1.0"
   layer: L3
-  model: haiku
+  model: sonnet
   group: validation
   tools: "Read, Glob, Grep"
 ---

package/skills/context-engine/SKILL.md

@@ -6,7 +6,7 @@ metadata:
   author: runedev
   version: "1.3.0"
   layer: L3
-  model: haiku
+  model: sonnet
   group: state
   tools: "Read, Glob, Grep"
   emit: context.preview, output.density.set
@@ -321,7 +321,7 @@ When ORANGE or RED is reached, use this table to determine whether compaction is
 
 ### Mid-Loop Compaction (Phase 4 Emergency)
 
-> From goclaw (nextlevelbuilder/goclaw, 832★): "Compact during run, not just at session boundary."
+Compact during the run, not just at the session boundary.
 
 When context hits RED during Phase 4 (implementation), compaction IS possible at **clean split points**:
 

package/skills/cook/SKILL.md

@@ -640,7 +640,7 @@ Escalation chain: debug-fix (3x) → re-plan (1x) → brainstorm rescue (1x) →
 
 ### Structured Escalation Report
 
-> From agency-agents (msitarzewski/agency-agents, 50.8k★): "After 3 retry failures, structured escalation prevents cargo-cult retrying."
+After 3 retry failures, structured escalation prevents cargo-cult retrying.
 
 When escalation chain exhausts (all retries hit) or cook returns `BLOCKED`, produce a Structured Escalation Report instead of a vague "I can't do this":
 
@@ -678,7 +678,7 @@ When escalation chain exhausts (all retries hit) or cook returns `BLOCKED`, prod
 
 ### Subagent Question Gate
 
-> From superpowers (obra/superpowers, 84k★): "Subagents that start work without asking questions produce the wrong thing 40% of the time."
+Subagents that start work without asking questions frequently produce the wrong thing.
 
 Before dispatching a sub-skill (fix, test, review) for a non-trivial task (3+ files OR ambiguous scope):
 

package/skills/cook/references/loop-detection.md

@@ -4,7 +4,7 @@ The Analysis Paralysis Guard (5-read counter in SKILL.md) catches obvious paraly
 This catches **same-input-same-output loops** — where the agent keeps calling the same tool
 with the same arguments and getting the same result, making zero progress.
 
-Source: goclaw (832★) — SHA256-based loop detection distinguishes true stuck loops from productive retries.
+Hash-based detection distinguishes true stuck loops from productive retries.
 
 ## Detection Logic
 

package/skills/cook/references/mid-run-signals.md

@@ -1,7 +1,7 @@
 # Mid-Run Signal Detection — Two-Stage Intent Classification
 
 When user sends a message DURING cook execution (mid-phase), classify intent before acting.
-Source: goclaw (832★) — two-stage intent classification prevents expensive LLM calls for simple signals.
+Two-stage intent classification prevents expensive LLM calls for simple signals.
 
 ## Stage 1 — Keyword Fast-Path
 

package/skills/debug/SKILL.md

@@ -5,7 +5,7 @@ metadata:
   author: runedev
   version: "1.4.0"
   layer: L2
-  model: sonnet
+  model: opus
   group: development
   tools: "Read, Bash, Glob, Grep"
   emit: bug.diagnosed, agent.stuck
@@ -282,7 +282,7 @@ Track fix attempts in the Debug Report. If this is attempt N>1 for the same symp
 
 ### 3+ Fixes as Architectural Signal
 
-> From superpowers (obra/superpowers, 84k★): "Each fix revealing new problems elsewhere = structural issue, not a bug hunt."
+Each fix revealing new problems elsewhere is a structural issue, not a bug hunt.
 
 When 3+ **distinct** fixes fail (not retries of the same fix), STOP treating it as a bug:
 

package/skills/dependency-doctor/SKILL.md

@@ -5,7 +5,7 @@ metadata:
   author: runedev
   version: "0.2.0"
   layer: L3
-  model: haiku
+  model: sonnet
   group: deps
   tools: "Read, Bash, Glob, Grep"
 ---

package/skills/design/SKILL.md

@@ -5,7 +5,7 @@ metadata:
   author: runedev
   version: "0.9.0"
   layer: L2
-  model: sonnet
+  model: opus
   group: creation
   tools: "Read, Write, Edit, Glob, Grep"
 ---

package/skills/docs/SKILL.md

@@ -177,7 +177,7 @@ Delegate to `rune:git changelog` to produce a changelog entry from commits since
 
 #### Step 4 — Cross-Doc Consistency Pass
 
-> From gstack (garrytan/gstack, 50.9k★): "Cross-document consistency prevents the #2 docs problem: docs that exist but contradict each other."
+Cross-document consistency prevents the second-most-common docs problem: docs that exist but contradict each other.
 
 After updating any doc, verify consistency across all project documentation:
 

package/skills/docs-seeker/SKILL.md

@@ -1,6 +1,9 @@
 ---
 name: docs-seeker
 description: "Find documentation for APIs, libraries, and error messages. Looks up official docs, changelog entries, and migration guides."
+context: fork
+agent: general-purpose
+model: haiku
 metadata:
   author: runedev
   version: "0.2.0"

package/skills/hallucination-guard/SKILL.md

@@ -5,7 +5,7 @@ metadata:
   author: runedev
   version: "0.3.0"
   layer: L3
-  model: haiku
+  model: sonnet
   group: validation
   tools: "Read, Bash, Glob, Grep"
 ---
@@ -78,7 +78,7 @@ If export not found → mark as **WARN** (symbol may not be exported).
 
 ### Step 3 — Verify external packages (Dependency Check Before Import)
 
-> From taste-skill (Leonxlnx/taste-skill, 3.4k★): "Before importing ANY 3rd party lib, check package.json."
+Before importing ANY third-party library, check the dependency manifest.
 
 Use `Read` on the project's dependency manifest to confirm each external package is listed:
 

package/skills/incident/SKILL.md

@@ -6,7 +6,7 @@ metadata:
   author: runedev
   version: "0.2.0"
   layer: L2
-  model: sonnet
+  model: opus
   group: delivery
   tools: "Read, Write, Edit, Bash, Glob, Grep"
   listen: incident.detected

package/skills/integrity-check/SKILL.md

@@ -6,7 +6,7 @@ metadata:
   author: runedev
   version: "0.2.0"
   layer: L3
-  model: haiku
+  model: sonnet
   group: validation
   tools: "Read, Glob, Grep"
   listen: quarantine.notice.emitted

package/skills/launch/SKILL.md

@@ -8,7 +8,7 @@ metadata:
   author: runedev
   version: "0.4.0"
   layer: L1
-  model: sonnet
+  model: opus
   group: orchestrator
   tools: "Read, Write, Edit, Bash, Glob, Grep"
   listen: audit.complete

package/skills/preflight/SKILL.md

@@ -103,7 +103,7 @@ const permissions = await fetchPermissions(id); // waits unnecessarily
 const [user, permissions] = await Promise.all([fetchUser(id), fetchPermissions(id)]);
 ```
 
-Flag each issue with: file path, line number, category (null-deref | missing-await | off-by-one | type-coerce), and a one-line description.
+Flag each issue with: file path, a **verbatim evidence snippet** copied from the file, category (null-deref | missing-await | off-by-one | type-coerce), and a one-line description. Record the snippet, not a line number — Step 6's Anchor Pass resolves the line with `Grep`.
 
 ### Step 2 — Error Handling
 For every changed file, verify:
@@ -132,7 +132,7 @@ app.use((err, req, res, next) => {
 });
 ```
 
-Flag each violation with: file path, line number, category (bare-catch | missing-status-check | raw-error-exposure), and description.
+Flag each violation with: file path, a **verbatim evidence snippet**, category (bare-catch | missing-status-check | raw-error-exposure), and description. Same rule as Step 1 — the snippet is what you produce; the line number comes from Step 6's Anchor Pass.
 
 ### Step 3 — Regression Check
 Use `rune:scout` to identify all files that import or depend on the changed files/functions.
@@ -337,7 +337,21 @@ Score is appended to the Preflight Report footer. Useful for tracking quality tr
 Invoke `rune:sentinel` on the changed files. Attach sentinel's output verbatim under the "Security" section of the preflight report. If sentinel returns BLOCK, preflight verdict is also BLOCK.
 
 ### Step 6 — Generate Verdict
-Aggregate all findings:
+
+**Falsification Pass first.** Before aggregating, filter findings by disproof, not by confidence — the same rule `review` applies (`../review/SKILL.md` → Step 6):
+
+- **DROP** a finding only when the code you read contains **direct counter-evidence** against its key claim (the null check exists, the `await` is present, the caller validates the input).
+- **KEEP** a finding that depends on context outside the diff which you did read via tools — that context is evidence.
+- **KEEP** a finding you can neither verify nor disprove. "Unsure" is not grounds to drop; only counter-evidence is.
+- Dropped findings are discarded silently, never listed as considered-and-dismissed.
+
+Type each surviving finding `OBSERVED | DERIVED | ASSUMED` per `../completion-gate/references/claim-discipline.md`. An `ASSUMED` finding — one resting on a premise you could not check — names that premise and **never escalates the verdict to BLOCK on its own**. It reports as WARN with the premise stated.
+
+**Anchor Pass second.** Every finding you collected in Steps 1-4 carries an evidence snippet, not a line number. Resolve each one now via the Anchor Ladder defined in `../review/SKILL.md` → Step 6: `Grep` the exact snippet, retry once whitespace-normalised with the outer lines dropped, and on a second miss mark the finding `UNANCHORED`.
+
+`UNANCHORED` behaves here exactly as it does in `review` — downgrade one level (BLOCK → WARN → INFO), report as `path (unanchored)` with the snippet inline, never drop. A finding that will not anchor **cannot carry the BLOCK verdict on its own**, for the same reason an `ASSUMED` one cannot: halting a pipeline on a claim nobody can locate spends the developer's trust faster than the bug would have.
+
+Then aggregate all surviving findings:
 - Any BLOCK from sentinel OR a logic issue that would cause data corruption or security bypass OR a dead interactive element (Step 4 cross-layer pairing / Step 4.5 dead-interactive check) OR a BLOCK from any domain hook → overall **BLOCK**
 - Any missing error handling, regression risk with no tests, or incomplete feature (other than the BLOCK cases above) → **WARN**
 - Only style or best-practice suggestions → **PASS**
@@ -346,18 +360,28 @@ Report PASS, WARN, or BLOCK. For WARN, list each item the developer must acknowl
 
 ## Output Format
 
-```
+````
 ## Preflight Report
 - **Status**: PASS | WARN | BLOCK
 - **Files Checked**: [count]
 - **Changes**: +[added] -[removed] lines across [files] files
+- **Unanchored**: [count — findings whose evidence did not resolve to a line]
 
 ### Logic Issues
-- `path/to/file.ts:42` — null-deref: `user.name` accessed without null check
-- `path/to/api.ts:85` — missing-await: async database call not awaited
+- `path/to/file.ts:42` — [OBSERVED] null-deref: `user.name` accessed without null check
+  ```ts
+  return user.name.trim();
+  ```
+- `path/to/api.ts (unanchored)` — [ASSUMED: caller in job.ts not read] missing-await: async database call not awaited
+  ```ts
+  db.orders.insert(row);
+  ```
 
 ### Error Handling
 - `path/to/handler.ts:20` — bare-catch: error swallowed silently
+  ```ts
+  } catch (e) {}
+  ```
 
 ### Regression Risk
 - `utils/format.ts` — changed function used by 5 modules, 2 have tests, 3 untested (WARN)
@@ -379,12 +403,14 @@ Report PASS, WARN, or BLOCK. For WARN, list each item the developer must acknowl
 
 ### Verdict
 WARN — 3 issues found (0 blocking, 3 must-acknowledge). Resolve before commit or explicitly acknowledge each WARN.
-```
+````
+
+Findings under Logic Issues and Error Handling show their evidence block; the Regression, Completeness, and Coherence sections describe file-level or structural gaps that have no single line to anchor, so they carry a path only.
 
 ## Constraints
 
 1. MUST check: logic errors, error handling, edge cases, type safety, naming conventions
-2. MUST reference specific file:line for every finding
+2. MUST anchor every line-level finding to a verbatim evidence snippet, resolving the line via the Anchor Pass rather than recall — unresolved findings report `(unanchored)`, downgraded one level, and cannot carry BLOCK alone
 3. MUST NOT skip edge case analysis — "happy path works" is insufficient
 4. MUST verify error messages are user-friendly and don't leak internal details
 5. MUST check that async operations have proper error handling and cleanup
@@ -424,7 +450,7 @@ WARN — 3 issues found (0 blocking, 3 must-acknowledge). Resolve before commit
 - Cross-layer pairing checked (Step 4): every new interactive component's handler chain reaches a real endpoint/service or has an explicit UI-only scope
 - Dead-interactive scan done (Step 4.5 UI hook) on all UI files in the diff
 - Sentinel invoked and its output attached in Security section
-- Structured report emitted with PASS / WARN / BLOCK verdict and file:line for every finding
+- Structured report emitted with PASS / WARN / BLOCK verdict, and every line-level finding anchored to a verbatim snippet (or reported `(unanchored)` and downgraded)
 
 ## Cost Profile
 

package/skills/rescue/SKILL.md

@@ -7,7 +7,7 @@ metadata:
   author: runedev
   version: "0.4.0"
   layer: L1
-  model: sonnet
+  model: opus
   group: orchestrator
   tools: "Read, Write, Edit, Bash, Glob, Grep"
 ---

package/skills/research/SKILL.md

@@ -5,7 +5,7 @@ metadata:
   author: runedev
   version: "0.4.0"
   layer: L3
-  model: haiku
+  model: sonnet
   group: knowledge
   tools: "Read, Glob, Grep, WebFetch, WebSearch"
 ---