skilldrop-cli 1.0.1 → 1.1.1

package/packs/core/skills/context-graph/evals/files/17/services/notifications/retry.py

@@ -0,0 +1,14 @@
+import time
+
+MAX_ATTEMPTS = 5
+BASE_DELAY_SECONDS = 2
+
+
+def with_retry(fn):
+    for attempt in range(1, MAX_ATTEMPTS + 1):
+        try:
+            return fn()
+        except Exception:
+            if attempt == MAX_ATTEMPTS:
+                raise
+            time.sleep(BASE_DELAY_SECONDS * 2 ** (attempt - 1))

package/packs/{solution-architect → core}/skills/context-graph/manifest.json

@@ -1,7 +1,7 @@
 {
   "name": "context-graph",
-  "version": "0.1.0",
-  "description": "Map the decisions behind a codebase from its ADRs, RFCs and design records — each record's status and date, what supersedes or amends what, which records cite which, the files and folders each decision governs, and with git the commits that implemented it — then answer \"why is it like this?\" from the record and check the record is still true. Finds supersessions only one side records, current decisions pointing at code that is gone, two current decisions governing the same path, and references to records that don't exist. Use when the user asks \"why do we use X\", \"which decisions govern this file or service\", \"is this ADR still current\", \"are our ADRs out of date\", \"what was decided before I change this\", wants a map of the architecture decisions, or is onboarding onto a codebase's history.",
+  "version": "0.2.0",
+  "description": "Map the decisions behind a codebase from its ADRs, RFCs and design records — each record's status and date, what supersedes or amends what, which records cite which, the files and folders each decision governs, and with git the commits that implemented it and the commits that changed each decision's code since it was made, and who made them — then answer \"why is it like this?\" from the record and check the record is still true. Finds supersessions only one side records, current decisions pointing at code that is gone, code that has drifted from its decision, two current decisions governing the same path, and references to records that don't exist. Use when the user asks \"why do we use X\", \"which decisions govern this file or service\", \"is this ADR still current\", \"has the code drifted since we decided this\", \"are our ADRs out of date\", \"what was decided before I change this\", wants a map of the architecture decisions, or is onboarding onto a codebase's history.",
   "entrypoint": "SKILL.md",
   "deps": { "npm": [], "pip": [] },
   "env": { "required": [], "optional": [] },
@@ -24,7 +24,7 @@
     "network": [],
     "commands": ["git"],
     "files": "named-paths",
-    "notes": "context_graph.py reads the decision-record folders under --root and checks whether the paths they name exist. With --git it runs `git log` read-only. It writes only to the -o and --mermaid paths."
+    "notes": "context_graph.py reads the decision-record folders under --root and checks whether the paths they name exist. With --git it runs `git log` read-only, for commit messages and for the commits that touched each governed path. It writes only to the -o and --mermaid paths."
   },
   "model": {
     "tier": "standard",

package/packs/{solution-architect → core}/skills/context-graph/reference.md

@@ -30,6 +30,7 @@ Every `.md` file in them, recursively, is a record, except:
 | missing paths | a path that looks like the repository's (its first part is a top-level folder that exists) but doesn't exist |
 | moved | for a missing path, an existing sibling with a close name (`services/ledger-sync` → `services/ledger`), where the code may have gone |
 | commits | with `--git`: commits whose subject or body mentions the id, newest first, up to 20 |
+| drift | with `--git`, for a current record that governs a path: the commits that changed those paths since the record's date, newest first. When the record has no date, they count from when its file was first committed. Each has its author and whether it cites the record. Also gives the authors and their counts, the last change, and when the record file was last edited. Merges are left out |
 
 **Statuses, normalised:**
 
@@ -81,6 +82,11 @@ A file that isn't UTF-8 is skipped, with a note in the report.
     "date": "2025-03-02", "path": "docs/adr/0004-….md",
     "supersedes": [], "superseded_by": [], "amends": [], "cites": [], "cited_by": [],
     "governs": ["services/orders/"], "missing_paths": [], "commits": [],
+    "drift": {"since": "2025-03-02", "since_from": "record", "count": 3, "not_citing_record": 2,
+              "authors": [{"name": "Ben", "commits": 2}, {"name": "Ana", "commits": 1}],
+              "last_change": "2026-06-04", "record_last_edited": "2025-03-02",
+              "commits": [{"sha": "a1b2c3d", "date": "2026-06-04", "author": "Ben", "subject": "…",
+                           "cites_record": false}]},
     "successors": ["ADR-0009"], "successors_only_claimed_by_successor": ["ADR-0009"],
     "moved": {"services/kafka-bridge": ["services/bridge"]}
   }],
@@ -91,9 +97,31 @@ A file that isn't UTF-8 is skipped, with a note in the report.
 }
 ```
 
+`drift` is `null` without `--git`, and for a record that isn't current or governs no path.
+
 `successors` joins a record's own "superseded by" with every record that says it supersedes this
 one. The second list holds the ones only the newer record records.
 
+## Code changed since each decision (`--git`)
+
+The full report gains a table of the current decisions whose governed code has changed since
+they were made, most changed first:
+
+| Column | Meaning |
+|---|---|
+| Decided | the record's date; `*` when it has none and the date is when the record was first committed |
+| Commits since | commits to the governed paths since that date, merges left out |
+| Not citing it | how many of those don't mention the record's id: the changes made without reference to it |
+| By | the authors, with their counts, most first |
+| Last change | the newest of those commits |
+| Record last edited | the last commit to the record file itself |
+
+`--why` adds a "Changed since" line under each current decision, and `--record` lists up to 10
+of the commits. The Markdown table shows 15 rows; `--json` has them all.
+
+A commit to a decision's code is a reason to check it, not drift by itself. Drift is a
+requirement in the record that the code no longer meets.
+
 ## Limits
 
 - **A decision made in a ticket or a chat, and never written down, isn't in the graph.** The

package/packs/{solution-architect → core}/skills/context-graph/scripts/context_graph.py

@@ -3,13 +3,14 @@
 
 Reads decision records (ADRs, RFCs, design decisions) as Markdown, finds each one's id, title,
 status and date, and the edges between them: what supersedes or amends what, which records cite
-which, the files and folders each one governs, and, with --git, the commits that mention it.
+which, the files and folders each one governs, and, with --git, the commits that mention it and
+the commits that changed each current decision's code since it was made, and who made them.
 Then it checks the graph for what goes wrong as a codebase ages: a supersession only one side
 records, a current decision pointing at code that is gone, two current decisions governing the
 same path, references to records that don't exist.
 
   python3 context_graph.py                          # find records under ./docs, check them
-  python3 context_graph.py --root repo --git        # and the commits that mention each record
+  python3 context_graph.py --root repo --git        # and the commits behind each record, and since it
   python3 context_graph.py --why src/auth/session.py
   python3 context_graph.py --record ADR-0004
   python3 context_graph.py --docs architecture/decisions --json -o graph.json --mermaid graph.mmd
@@ -191,7 +192,7 @@ def parse_record(path, root, text):
     rec = {"id": rid, "title": title_of(meta, body, stem.replace("-", " ")), "status": status,
            "status_text": raw_status, "date": date_of(meta, body), "path": rel,
            "supersedes": [], "superseded_by": [], "amends": [], "cites": [], "governs": [],
-           "missing_paths": [], "commits": []}
+           "missing_paths": [], "commits": [], "drift": None}
     rec["supersedes"] += list_ids(meta.get("supersedes", "")) + list_ids(meta.get("replaces", ""))
     rec["superseded_by"] += list_ids(meta.get("superseded_by", "")) + list_ids(meta.get("replaced_by", ""))
     rec["amends"] += list_ids(meta.get("amends", ""))
@@ -290,6 +291,69 @@ def git_commits(root, records, limit):
     return None
 
 
+def _git(root, *args):
+    """stdout of a git command in root, or None when git is missing or the command fails."""
+    try:
+        out = subprocess.run(["git", "-C", root, *args], capture_output=True, text=True,
+                             encoding="utf-8", errors="replace", timeout=60)
+    except (OSError, subprocess.SubprocessError):
+        return None
+    return out.stdout if out.returncode == 0 else None
+
+
+def git_drift(root, records, limit):
+    """For each current decision that governs code: the commits that changed that code since the
+    decision was made, who made them, and when the record itself was last edited. Code that keeps
+    changing under a record nobody revisits is where a decision quietly stops being true."""
+    for r in records:
+        if r["status"] not in CURRENT or r["successors"] or not r["governs"]:
+            continue
+        since, source = r["date"], "record"
+        if not since:  # no date in the record: when the record was first committed
+            added = _git(root, "log", "--diff-filter=A", "--follow", "--date=short", "--format=%ad", "--", r["path"])
+            since, source = ((added or "").split() or [""])[-1], "git"
+        if not since:
+            r["drift"] = {"since": None, "note": "the record has no date and isn't committed, so changes since it can't be dated"}
+            continue
+        log = _git(root, "log", "--no-merges", "--since=%s 00:00" % since, "-n", str(limit), "--date=short",
+                   "--format=%h%x1f%ad%x1f%an%x1f%s%x1f%b%x1e", "--", *[g.rstrip("/") or "." for g in r["governs"]])
+        commits = []
+        for entry in (log or "").split("\x1e"):
+            parts = entry.strip("\n").split("\x1f")
+            if len(parts) < 4:
+                continue
+            body = parts[4] if len(parts) > 4 else ""
+            commits.append({"sha": parts[0], "date": parts[1], "author": parts[2], "subject": parts[3][:120],
+                            "cites_record": r["id"] in ids_in(parts[3] + "\n" + body)})
+        authors = {}
+        for c in commits:
+            authors[c["author"]] = authors.get(c["author"], 0) + 1
+        edited = (_git(root, "log", "-1", "--date=short", "--format=%ad", "--", r["path"]) or "").strip()
+        r["drift"] = {
+            "since": since, "since_from": source, "count": len(commits),
+            "not_citing_record": sum(1 for c in commits if not c["cites_record"]),
+            "authors": [{"name": n, "commits": k} for n, k in sorted(authors.items(), key=lambda x: (-x[1], x[0]))],
+            "last_change": commits[0]["date"] if commits else None,
+            "record_last_edited": edited or None,
+            "commits": commits[:20],
+        }
+
+
+def drift_line(d):
+    """One line: '12 commits by Ana (9), Ben (3) since 2026-02-10, the last on 2026-09-30'."""
+    if not d or d.get("since") is None:
+        return (d or {}).get("note", "")
+    if not d["count"]:
+        return "no commits have changed its code since %s" % d["since"]
+    who = ", ".join("%s (%d)" % (a["name"], a["commits"]) for a in d["authors"][:4]) + (" …" if len(d["authors"]) > 4 else "")
+    cite = "" if not d["not_citing_record"] else ("; %d don't cite the record" % d["not_citing_record"]
+                                                  if d["not_citing_record"] < d["count"] else "; none cites the record")
+    return "%d commit%s by %s since %s%s, the last on %s%s" % (
+        d["count"], "" if d["count"] == 1 else "s", who, d["since"],
+        " (when the record was committed; it has no date)" if d.get("since_from") == "git" else "",
+        d["last_change"], cite)
+
+
 SKIP_DIRS = {".git", "node_modules", "vendor", "dist", "build", ".venv", "venv", "__pycache__", "target"}
 
 
@@ -432,7 +496,8 @@ def why(records, path, root):
     hits.sort(key=lambda h: (0 if live(h[0]) else 1, rank.get(h[0]["status"], 2),
                              -int(h[0]["date"].replace("-", "") or 0)))
     return p, [{"id": r["id"], "title": r["title"], "status": r["status"], "date": r["date"], "path": r["path"],
-                "via": g, "superseded_by": sorted(set(succ.get(r["id"], []))), "current": live(r)} for r, g in hits]
+                "via": g, "superseded_by": sorted(set(succ.get(r["id"], []))), "current": live(r),
+                "drift": r.get("drift")} for r, g in hits]
 
 
 def mermaid(records):
@@ -479,6 +544,8 @@ def report(records, findings, note, query, dirs, root):
                     state = h["status"] + (", current" if h["current"] else "")
                 out.append("- **%s %s** (%s%s), via `%s`: %s" % (
                     h["id"], h["title"], state, ", " + h["date"] if h["date"] else "", h["via"], h["path"]))
+                if h.get("drift"):
+                    out.append("  - Changed since: %s" % drift_line(h["drift"]))
             if not cur:
                 out.append("\nNone of these is current: the decisions that governed it were superseded, "
                            "deprecated or never accepted.")
@@ -502,6 +569,13 @@ def report(records, findings, note, query, dirs, root):
                 out.append("- %s: %s" % (label, ", ".join(r[k])))
         for c in r["commits"]:
             out.append("- Commit %s %s: %s" % (c["sha"], c["date"], c["subject"]))
+        if r.get("drift"):
+            out.append("- Code changed since the decision: %s" % drift_line(r["drift"]))
+            if r["drift"].get("record_last_edited"):
+                out.append("- Record last edited: %s" % r["drift"]["record_last_edited"])
+            for c in r["drift"].get("commits", [])[:10]:
+                out.append("  - %s %s %s: %s%s" % (c["sha"], c["date"], c["author"], c["subject"],
+                                                    " (cites it)" if c["cites_record"] else ""))
         out.append("")
     counts = {}
     for r in records:
@@ -516,6 +590,28 @@ def report(records, findings, note, query, dirs, root):
     out += ["- %s %s" % (rid, msg) for _, rid, msg in probs] or ["None."]
     out.append("\n## Warnings (%d)\n" % len(warns))
     out += ["- %s %s" % (rid, msg) for _, rid, msg in warns] or ["None."]
+    drifted = sorted((r for r in records if r.get("drift") and r["drift"].get("count")),
+                     key=lambda r: (-r["drift"]["count"], r["id"]))
+    if not query and any(r.get("drift") for r in records):
+        out.append("\n## Code changed since each decision\n")
+        if not drifted:
+            out.append("No commit has changed the code a current decision governs since it was made.")
+        else:
+            out.append("Current decisions whose code has changed since they were made, most changed first. "
+                       "Each is a place to check that the code still does what the record says.\n")
+            out.append("| Record | Decided | Commits since | Not citing it | By | Last change | Record last edited |")
+            out.append("|---|---|---|---|---|---|---|")
+            for r in drifted[:15]:
+                d = r["drift"]
+                out.append("| %s %s | %s%s | %d | %d | %s | %s | %s |" % (
+                    r["id"], r["title"].replace("|", "/")[:50], d["since"], "*" if d["since_from"] == "git" else "",
+                    d["count"], d["not_citing_record"],
+                    ", ".join("%s (%d)" % (a["name"].replace("|", "/"), a["commits"]) for a in d["authors"][:3])
+                    + (" …" if len(d["authors"]) > 3 else ""), d["last_change"], d["record_last_edited"] or "-"))
+            if len(drifted) > 15:
+                out.append("\n…and %d more; `--json` lists them all." % (len(drifted) - 15))
+            if any(r["drift"]["since_from"] == "git" for r in drifted[:15]):
+                out.append("\n\\* The record has no date, so this counts from when it was first committed.")
     if not query:
         out.append("\n## Graph\n")
         out.append("| Record | Status | Date | Supersedes | Superseded by | Governs |")
@@ -536,7 +632,9 @@ def _main(argv=None):
     q = ap.add_mutually_exclusive_group()
     q.add_argument("--why", metavar="PATH", help="list the decisions that govern a file or folder")
     q.add_argument("--record", metavar="ID", help="show one record and its neighbours, e.g. ADR-0004")
-    ap.add_argument("--git", action="store_true", help="also read commit messages for record ids")
+    ap.add_argument("--git", action="store_true",
+                    help="also read the commits that mention each record, and those that changed each current "
+                         "decision's code since it was made")
     ap.add_argument("--git-limit", type=int, default=5000)
     ap.add_argument("--json", action="store_true", help="print the graph as JSON instead of Markdown")
     ap.add_argument("--mermaid", metavar="FILE", help="also write a Mermaid flowchart of the graph")
@@ -579,6 +677,8 @@ def _main(argv=None):
         claimed = [o["id"] for o in records if r["id"] in o["supersedes"]]
         r["successors"] = sorted(set(r["superseded_by"]) | set(claimed))
         r["successors_only_claimed_by_successor"] = sorted(set(claimed) - set(r["superseded_by"]))
+    if a.git and not any("no commits were read" in n for n in notes):
+        git_drift(root, records, a.git_limit)
     # Guides and READMEs that still cite a superseded decision may still teach it.
     by_id = {r["id"]: r for r in records}
     docs = other_docs(root, {r["path"] for r in records})

package/packs/dev-team/loops/modernize/LOOP.md

@@ -16,7 +16,7 @@ can accept what the recordings don't cover and approve every intended change.
 
 | # | Stage | Type | Skills | Gate |
 |---|---|---|---|---|
-| 1 | `survey` | generate | [`codebase-tour`](../../skills/codebase-tour/SKILL.md) | — |
+| 1 | `survey` | generate | [`codebase-tour`](../../skills/codebase-tour/SKILL.md), [`context-graph`](../../../core/skills/context-graph/SKILL.md) | — |
 | 2 | `plan` | generate | [`refactor-plan`](../../skills/refactor-plan/SKILL.md), [`migration-plan`](../../skills/migration-plan/SKILL.md) | — |
 | 3 | `capture` | generate | [`behaviour-equivalence`](../../skills/behaviour-equivalence/SKILL.md) | — |
 | 4 | `rebuild` | generate | [`feature-implement-loop`](../../skills/feature-implement-loop/SKILL.md) | — |
@@ -29,6 +29,15 @@ can accept what the recordings don't cover and approve every intended change.
    must end with the boundary it will be swapped at (an HTTP API, a function signature, a
    batch file, a queue) and every caller and side effect that crosses it, each cited to a
    file. A boundary nobody can name means the component isn't ready to be replaced.
+
+   Then run `context-graph` on the same component, with git history. It finds the recorded
+   decisions that govern it: why it was built this way, what was tried before, and the
+   constraints the rewrite must keep. It also finds where the code has changed since those
+   decisions were made, and who changed it. Carry every constraint a current decision sets
+   into `plan`. A behaviour the old code has that contradicts its decision is a question for
+   the owner before `capture`: record it as it is, and ask whether the rewrite should keep it.
+   Each person who changed the code since the decision is worth asking what the records don't
+   say.
 2. **Plan the work.**
    - Restructuring the code in place → `refactor-plan`.
    - Moving data, a schema or a platform → `migration-plan`.
@@ -122,3 +131,4 @@ The log holds verdicts only: never recordings, code or data.
 - ❌ **Rebuilding everything, then comparing once.** Each planned step merges on its own and is compared again.
 - ❌ **Calling the migration done at G10.** Equivalence on the recordings is evidence; the cutover is a person's decision, with a rollback.
 - ❌ **Skipping `survey` because the old code is "well known".** The callers and side effects nobody remembers are the ones that break.
+- ❌ **Rewriting without reading the decisions behind the old code.** A constraint someone recorded years ago, such as a retention period or an ordering guarantee, is easy to drop in a rewrite and expensive to rediscover in production.

package/packs/dev-team/loops/modernize/evals/evals.json

@@ -22,6 +22,18 @@
         "Says a new or wider normalisation rule is a return to capture, not a fix",
         "Counts the return under the cap of 3"
       ]
+    },
+    {
+      "id": "survey-reads-the-recorded-decisions",
+      "prompt": "Run the modernize loop. We're replacing services/billing (a Python 2 batch job) with a Go service. The repo has ADRs under docs/adr.",
+      "assertions": [
+        "Surveys the boundary and every caller and side effect that crosses it, each cited to a file, before planning",
+        "Reads the ADRs that govern services/billing and names the current one by id, status and date",
+        "Carries each constraint the current decision sets into the plan",
+        "Says where the code has changed since the decision was made, from the git history, and who changed it, or says git history wasn't available",
+        "Treats a behaviour that contradicts the recorded decision as a question for the owner before capture, not as something to fix silently in the rewrite",
+        "Does not invent decisions, ids, commits or people that are not in the repository"
+      ]
     }
   ]
 }

package/packs/dev-team/loops/modernize/loop.json

@@ -1,7 +1,7 @@
 {
   "$comment": "RFC-0057. A legacy component replaced without changing what it does. The old system's behaviour is recorded before anything is rebuilt, a script decides G10 from the recordings, and a person decides the cutover, because only they can accept the coverage and the listed changes.",
   "name": "modernize",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Replace or rewrite a legacy component without changing what it does: orient in the old code, plan the restructuring and the move, record the old system's behaviour before anything is rebuilt, rebuild in small steps, prove the new one gives the same results on the recordings, and cut over only when a person accepts the evidence. Use when the user is migrating, rewriting or porting a legacy service, batch job or module (COBOL to Java, Python 2 to 3, a monolith to a service, one framework to another), says \"run the modernize loop\", or asks how to replace old code without breaking what depends on it.",
   "entrypoint": "LOOP.md",
   "kind": "loop",
@@ -10,8 +10,8 @@
     {
       "id": "survey",
       "type": "generate",
-      "intent": "Find the boundary the component is replaced at, what crosses it, who calls it, and the traps in the old code, each cited to a file.",
-      "skills": ["codebase-tour"]
+      "intent": "Find the boundary the component is replaced at, what crosses it, who calls it, and the traps in the old code, each cited to a file; then the recorded decisions that govern it, and which of them the code has drifted from.",
+      "skills": ["codebase-tour", "context-graph"]
     },
     {
       "id": "plan",

package/packs/frontend/skills/bundle-size-review/SKILL.md

@@ -61,9 +61,10 @@ Reads the bundler's own record of what it built, and the repo files that decide
 
 11. **Reply short, in one message, in this order.**
     - **First line answers the question in the person's words.** ✅ *"Yes, the reviewer is right: echarts moved from the lazy reports chunk into vendors, so the first load grew from 311,282 to 803,674 bytes (+492,392) while the total fell 1,949."* ❌ *"This confirms it."* / *"Let me break this down."*
-    - **Then the fixes, numbered by first-load impact:** what it is, the chain, the change, what to check after. Two to four lines each.
+    - **Then the fixes, numbered by first-load impact:** what it is, the chain, the change, what to check after. Two to four lines each. The change is the exact edit, in the file the chain names, ready to apply: the import line to replace and its replacement, or a short diff. ✅ *"In `src/components/Header.tsx`, replace `import * as Icons from "@acme/icons"` with `import { SearchIcon, MenuIcon } from "@acme/icons"`."* ❌ *"Consider lazy-loading the locales."*
+    - **Edit files only when asked to change the code** ("fix it", "cut it", "open the PR"). Then make the edit, keep everything users rely on working, and say you couldn't rebuild if you couldn't. A question ("why is it big?") gets the edits in the reply, and the files stay untouched.
     - **One line on lazy chunks** when they matter to the question.
-    - **Then the guard:** the per-entry budget that would have caught it, with its threshold.
+    - **Then the guard:** the per-entry budget that would have caught it, with its threshold, as configuration for a tool the repo has or a named package to add: webpack `performance` (`hints: "error"`, `maxEntrypointSize`), a size-limit entry (`path`, `limit`), or the existing CI file's step. Never a script, flag or config key that doesn't exist; when you're unsure a tool takes an option, leave it out.
     - **"To confirm"** for what only the user can answer; omit it when empty. No module tables, no full package lists, no tool output pasted in, no flags or options that don't exist. About 250 words.
 
 **Non-interactive runs** (subagent, CI, headless): with no stats file, emit `BLOCKED: need the bundler stats file (webpack --json, esbuild --metafile, or rollup-plugin-visualizer raw-data)`. With only built files or a treemap screenshot, report the per-file sizes and emit `BLOCKED: need the stats file to say what is inside each chunk`. Browser targets absent from every project file (after looking) become `[assumption] browser targets unknown; polyfill findings unconfirmed`; a missing budget becomes `[assumption] budget set at the current initial size plus 5%`.
@@ -78,6 +79,8 @@ Reads the bundler's own record of what it built, and the repo files that decide
 
 - **The first line answers the question** in the person's terms, with the exact byte figures from the stats.
 - **The repo was read:** targets, versions and importing files are cited by file name; nothing is called absent without having been looked for.
+- **Each fix is an exact edit to a named file;** files are changed only when the user asked for changes.
+- **The guard is real configuration** for a tool that exists, with no invented flag, script or key.
 - **One unit system,** bytes with kB = 1000, and the kind of size (module, emitted, post-bundle, compressed) is named once.
 - **Compressed figures are measured or absent,** never estimated into the lead.
 - **Initial and lazy are kept apart,** and a lazy chunk is never ranked above an initial-chunk fix.

package/packs/frontend/skills/bundle-size-review/evals/evals.json

@@ -103,6 +103,36 @@
         "Invents nothing that is not in the input: no component names, package versions, file paths, chunk or asset sizes, or webpack/plugin options beyond what the stats and repo files contain. Any tool that would need installing from the network is given as a command, not presented as already run.",
         "Answers all three numbered questions directly, per app, in the order asked."
       ]
+    },
+    {
+      "id": 8,
+      "held_out": "2026-10-22",
+      "prompt": "ok so our welcome page (welcome.html, the `landing` entry) scores terribly on mobile and Priya from product says \"the bundle is huge, it's moment, just rip moment out\". is she right?? I ran the build with stats, it's at dist/stats.json, rest of the repo is here. what do we actually cut first, we want the landing page JS under 200kb",
+      "assertions": [
+        "Answers both questions directly up front: Priya is wrong about moment for this page, and it names what to cut first for the landing page (app-only vendor code, whole lodash, the legacy polyfills), not a generic bundle audit.",
+        "Shows that moment (./node_modules/moment/moment.js plus its locale context modules) is only in the lazy `admin` chunk (admin.e91c5d.js, 82,310 bytes), pulled in by the dynamic import() of ./admin/Reports in src/app/App.jsx, so it is not in the landing entry's first load and removing it would not shrink welcome.html's JavaScript.",
+        "Gives the landing entry's first-load JS as 287,994 bytes from the stats (runtime.3f1a9c.js 2,615 + vendors.8c2d41.js 281,467 + landing.a07e93.js 3,912), kept apart from the lazy admin chunk, and says the stats record minified, uncompressed bytes, so it cannot tell from them whether '200kb' (gzip or not, 1000 or 1024) is met; it gives a command to measure compressed size (e.g. `gzip -c dist/vendors.8c2d41.js | wc -c`) instead of making up a gzip figure.",
+        "Spots that the single `vendors` cacheGroup in webpack.config.js (fixed name: 'vendors', chunks: 'initial') makes the landing entry download node_modules that only the app entry uses. @northwind/datepicker and both copies of date-fns are reached only from ./src/app/BookingForm.jsx. It recommends dropping the fixed name, or splitting vendors per entry, so landing gets only what its own import chain needs.",
+        "Flags the whole-library lodash import and names the chain src/landing/index.jsx -> src/landing/Hero.jsx -> src/utils/format.js (`import _ from 'lodash'`) -> ./node_modules/lodash/lodash.js. It notes that lodash is CommonJS and can't be tree-shaken, and that only startCase, toLower and debounce are used, so it suggests per-method imports (e.g. lodash/startCase), lodash-es or native code.",
+        "Flags whatwg-fetch and promise-polyfill, which src/polyfills.js loads into both entries through the webpack entry arrays, as unneeded for the .browserslistrc targets (last 2 Chrome/Firefox/Safari/Edge/iOS versions, all with native fetch and Promise), and treats the IE11 comment as outdated.",
+        "Notes that date-fns is bundled twice: 2.30.0 at node_modules/date-fns (from the app's ^2.30.0) and 3.6.0 at node_modules/@northwind/datepicker/node_modules/date-fns, per package-lock.json.fixture/package-lock.json. It says that removing the duplicate means moving the app to date-fns 3 (checking the v2-to-v3 changes for format/parseISO in BookingForm.jsx), and it does not subtract the stats' module sizes, which are pre-minification source bytes (e.g. lodash.js at 544,098, more than the whole 281,467-byte vendors asset), from the emitted bytes as if they were savings. Post-change sizes are given as estimates to confirm by running `npm run build:stats`.",
+        "Invents nothing that isn't in the input: no module, package version, file name, byte count, gzip size or webpack option beyond what dist/stats.json and the repo files contain, and no claim that it ran a build."
+      ]
+    },
+    {
+      "id": 9,
+      "held_out": "2026-10-22",
+      "prompt": "We ship Parcelpost Chat, an embeddable support widget customers load with <script type=\"module\" src=\".../widget.js\">. Since PR #412 (emoji picker) went out, two customers have told us the widget adds a lot more to their page weight. But our size check in CI passed, and it actually said widget.js got smaller. The repo here is the PR branch, and I've saved the esbuild metafiles from a main build and a PR build as meta.main.json and meta.pr412.json. What grew and why? Is it on the initial load? And how should we change the size check so this gets caught next time?",
+      "assertions": [
+        "Answers directly up front: the widget's first-load JS went from 21,312 bytes (dist/widget.js alone on main) to 118,910 bytes on PR #412 (dist/widget.js 10,215 + the statically imported dist/chunk-R4N7QW2L.js 108,695), a growth of 97,598 bytes, and all of it is on the initial load.",
+        "Explains why widget.js 'got smaller' (21,312 to 10,215): preact and preact/hooks (10,214 + 1,436 bytesInOutput) moved out of widget.js into the shared chunk because the picker imports them too. This is a relocation, not a saving.",
+        "Names the cause and the import chain: src/emoji/emoji-data.json (96,512 bytesInOutput in the shared chunk) reaches the initial load via src/widget.ts -> src/composer.tsx -> src/emoji/data.ts -> src/emoji/emoji-data.json. The static `import { SHORTCODES } from './emoji/data'` added to composer.tsx defeats the dynamic import('./emoji/picker').",
+        "Keeps dist/picker-6YB3KD5M.js (5,920 bytes) separate as a lazy chunk, fetched only when the picker opens, and does not count it in the first-load growth.",
+        "Proposes a fix that keeps the emoji data off the initial load, such as loading SHORTCODES lazily (when the picker opens or the visitor first types ':') or using a small separate shortcode map, and says to confirm it with a rebuild (e.g. `META_OUT=meta.fix.json npm run build`) instead of stating post-fix byte counts as fact.",
+        "Explains that the check passed because scripts/check-size.mjs only measures dist/widget.js against 25,000 bytes. It proposes a per-entry first-load budget computed from the metafile (the entry output plus every output reachable through import-statement imports, excluding dynamic-import), which would have measured 118,910 bytes on PR #412 and failed the 25,000 limit. Lazy chunks can get their own separate limit.",
+        "Stays with the minified, uncompressed bytes the metafiles record and doesn't claim gzip/brotli transfer sizes (what customers' 'page weight' probably reflects). If it wants compressed numbers, it gives a command such as `gzip -c dist/chunk-*.js | wc -c` to run.",
+        "Invents nothing that isn't in the input: no output file, input module, byte count, esbuild option or CI step beyond what the metafiles and repo files contain, and no claim that it ran the build."
+      ]
     }
   ]
 }

package/packs/frontend/skills/bundle-size-review/evals/files/8/.browserslistrc

@@ -0,0 +1,6 @@
+# Support matrix agreed with product, 2025-03
+last 2 Chrome versions
+last 2 Firefox versions
+last 2 Safari versions
+last 2 Edge versions
+last 2 iOS versions

package/packs/frontend/skills/bundle-size-review/evals/files/8/babel.config.js

@@ -0,0 +1,6 @@
+module.exports = {
+  presets: [
+    ['@babel/preset-env', { modules: false }],
+    ['@babel/preset-react', { runtime: 'automatic' }],
+  ],
+};