remigiusz-antczak · Oct 30, 2026 · Oct 30, 2026
diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json
@@ -2,7 +2,7 @@
   "name": "perun",
   "description": "Perun: a suite of skills for building with AI agents. Deep code review, token and cost tools (spend reports, auto-compact with handoff, model-tier guidance), gated agentic delivery (merge train, lanes, destructive-command guard, auto-update), an idea critic, and product, growth, positioning, business-ops and output-safety specialists.",
   "skills": "./.claude/skills",
-  "version": "1.622.0",
+  "version": "1.623.0",
   "author": {
     "name": "deep-code-review contributors"
   },

diff --git a/.claude/skills/agentic-delivery/SKILL.md b/.claude/skills/agentic-delivery/SKILL.md
@@ -8,7 +8,7 @@ description: >-
 license: MIT
 metadata:
   author: deep-code-review contributors
-  version: "1.622.0"
+  version: "1.623.0"
 ---
 
 # Agentic delivery

diff --git a/.claude/skills/agentic-delivery/VERSION b/.claude/skills/agentic-delivery/VERSION
@@ -1 +1 @@
-1.622.0
+1.623.0
diff --git a/.claude/skills/deep-code-review/SKILL.md b/.claude/skills/deep-code-review/SKILL.md
@@ -8,7 +8,7 @@ description: >-
 license: MIT
 metadata:
   author: deep-code-review contributors
-  version: "1.622.0"
+  version: "1.623.0"
 ---
 
 # Deep Code Review

diff --git a/.claude/skills/deep-code-review/VERSION b/.claude/skills/deep-code-review/VERSION
@@ -1 +1 @@
-1.622.0
+1.623.0
diff --git a/.claude/skills/idea-critic/SKILL.md b/.claude/skills/idea-critic/SKILL.md
@@ -8,7 +8,7 @@ description: >-
 license: MIT
 metadata:
   author: deep-code-review contributors
-  version: "1.622.0"
+  version: "1.623.0"
 ---
 
 # Veles: the evil twin (idea-critic)

diff --git a/.claude/skills/idea-critic/VERSION b/.claude/skills/idea-critic/VERSION
@@ -1 +1 @@
-1.622.0
+1.623.0
diff --git a/.codex-plugin/plugin.json b/.codex-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "perun",
-  "version": "1.622.0",
+  "version": "1.623.0",
   "description": "Perun: a skill suite for AI-agent teams: deep code review, token and cost tools, gated delivery, an idea critic and product specialists.",
   "skills": "./.claude/skills",
   "interface": {

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -3,6 +3,44 @@
 All notable changes to this repository are documented here. Format loosely
 follows Keep a Changelog; versioning follows Semantic Versioning.
 
+## [1.623.0] — 2026-10-30
+
+### Fixed
+- `scripts/ci-gates.sh rules` now compares its sorted rows in the C locale, like the `sort -u` calls that feed them. Under a UTF-8 locale such as `en_US.UTF-8` its two `comm` calls saw unsorted input, so a baseline with a few rows could report a baselined rule as new, or a baseline that only shrank as grown and needing a `rule-baseline-raise:` line. The shipped baseline is empty, so nothing failed yet. Regression test: `scripts/test-rules-locale.sh` (registered from `scripts/ci-tests.d/rules-locale.sh`) runs the gate under C and `en_US.UTF-8`.
+
+### Added
+- `scripts/ci-gates.sh tests-wired --allowlist <file> <root>`: a standing check that every `scripts/test_*.py` and `scripts/test-*.sh` is run by CI. A test counts as run when `scripts/ci-tests.d/*.sh`, a `.github/workflows/*.yml` step, or a test those run (for example `test-ci-gates.sh`) names it on a non-comment line; otherwise it needs a `name<TAB>reason` row in `scripts/ci-test-allowlist.tsv`. A row without a reason, for a missing file, or for a test CI already runs also fails, so the list only shrinks. It runs from `scripts/ci-tests.d/tests-wired.sh`; its regression test is `scripts/test-tests-wired.sh` (a planted orphan fails, and it gives the same answers under `en_US.UTF-8` as under the C locale).
+- The first run found 71 tests that no CI step ran: 59 are now registered (`secret-rule-waves.sh`, `security-gate-waves.bg.sh` as a background suite, `orphan-tests-misc.sh`, `orphan-tests.sh`) and the 12 corpus re-scores of 30 s or more are allowlisted with their measured runtimes.
+
+### Fixed
+- `scripts/test_auto_update_legacy_marker.py` took about 326 s because it copied `docs/bench` (about 90k files) into a scratch tree; it now skips that directory and runs in about 4 s. Its `install.sh` run, `scripts/test_install_canonical_global.py` and `scripts/test_peer_pains_5.py` now set `DCR_NO_PROBE=1`, so none of them calls github.com through the sandbox probe.
+
+### Added
+- `veche.py`: a decided record carries `kill_criteria_by_lens` (`{lens: text}`), each seat's own kill criterion as worded before near-duplicates collapse, so a reader can see which seat asked for which tripwire. It is additive: `kill_criteria` and `validate_verdict.py` are unchanged, a seat that gave none is left out of the map, and the evil twin's criterion stays in `minority_report.twin` (#2140).
+
+### Changed
+- `veche.py --help`: `--option` states the exact name rule (the `TOKEN` pattern, which the refusal for a bad name now quotes too), `--stakes` and `--reversibility` state the real gate (the council is skipped only when stakes are low or medium and reversibility is easy, and either flag alone convenes), and `--json-out` says how the file is written (#2136, #2139).
+- `council.md` states the reply contract a custom `--cmd` must meet, as the parser really accepts it: a JSON object with a `verdict` and string-only `claims` items, prose and stray braces around it skipped, the first object with a valid `verdict` wins, and the `scores` map may sit in the verdict object or in any other object (#2137). It also lists `kill_criteria_by_lens` in the output row.
+
+### Fixed
+- `veche.py --json-out` writes through a temp file in the same directory and `os.replace`, at the early write and at the final one and on every outcome, so a reader or a crash never sees half a record. A symlinked path keeps pointing at its target, an existing file keeps its mode, a device or FIFO target is written in place, and an unwritable path still exits 2 with the `--json-out: cannot write` message (#2139).
+
+### Fixed
+- The wall-clock pins of `scripts/test_destructive_guard_w20.py`, `scripts/test_secret_extra_rules_w12.py`, `scripts/test_secret_extra_rules_w13.py` and `scripts/test_secret_extra_rules_w14.py` (0.2 s and 0.5 s on 100 KB lines) are now 2.0 s, so a loaded CI runner no longer fails them; a catastrophic-backtracking regression still takes far longer.
+- `scripts/test-rules-locale.sh` and `scripts/test-tests-wired.sh` print `SKIP  en_US.UTF-8 ...` and run their C-locale cases when the runner has no `en_US.UTF-8`, instead of failing on a locale that is not installed.
+
+### Changed
+- `veche.py --help` states the `--json-out` directory rule: the record is written through a temp file beside the target, so a read-only file in a writable directory is replaced, while a read-only directory or a bind-mounted file exits 2. Test: `scripts/test_veche_doc_claims.py`.
+- `council.md` says the `scores` map may sit under `scores` in the verdict object itself, or in any other object (bare or under `scores`), as `veche.py` reads it.
+
+### Fixed
+- `comms_lint.py` `audit-pr`: the attribution footer may sit in markup. A `<sub>🤖 Generated with ...</sub>` line (with or without a `---` rule before it), a `*Generated with ...*` or `_Generated by ..._` line after a rule or the robot line, and a `Co-Authored-By:` line in the same markup are footer-shaped, so a compliant body that ends with one no longer fails "Not fixed carries detail ('https://')". Markup alone does not make a footer: a wrapped line that is not a Generated or Co-Authored-By line, a Generated line with no rule or robot before it, and anything after a footer are still checked. The accepted markup is bounded (`<sub>`, `<sup>`, `<small>`, `*`, `_`, at most six), so a long run of `*` stays linear. `references/artifact-templates.md` states the rule. Test: `scripts/test_audit_pr_footer_markup.py`.
+- `veche.py`: the kill-criteria dedupe key maps `≤` to `<=` and `≥` to `>=` first, so `rate ≤ 5%` and `rate <= 5%` are one tripwire (the first wording stays), while `≤` against `≥` and `<` against `≤` stay two. Test: `scripts/test_veche_uniq_unicode_fold.py`.
+- `veche.py --json-out`: a write that fails at the end of the run no longer turns a blocking verdict into exit 2. `COULD_NOT_DECIDE` keeps exit 3 and `NOT_CONVENED` keeps exit 4; only a verdict that would exit 0 becomes exit 2. The stderr message is unchanged, and `council.md` says so in one clause. Test: `scripts/test_veche_json_out_exit_code.py` (a write that works once, then fails, for each of the three outcomes).
+- `scripts/test-review-checks-scan-summary.sh` unsets `REVIEW_SEMGREP_REGISTRY`, so a host that sets it to `0` (which drops the `--config p/default` the test expects) still passes. Test: `scripts/ci-tests.d/review-checks-scan-summary-registry-env.sh` runs it with the variable set to `0`.
+- size-budget-raise: .claude/skills/communication-structure/references/artifact-templates.md 9171→9234 the audit-pr footer sentence names the markup a footer line may sit in
+- size-budget-raise: .claude/skills/idea-critic/references/council.md 9071→9516 kill_criteria_by_lens in the output row, one sentence stating the --cmd reply contract (the verdict object may carry the scores), and one clause: a --json-out write that fails at the end exits 2 only when the verdict would exit 0
+
 ## [1.622.0] — 2026-10-30
 
 ### Added

diff --git a/SHA256SUMS b/SHA256SUMS
@@ -20,8 +20,8 @@ b1080da06ca20a2807ea7be3a25cb95b94c97a6c2a686401796ffc3adac3ee37  .claude/skills
 9521b057ff3db92d1e60923ebd88170713914f7e235ceb45717eb39419daf811  .claude/skills/agentic-ceo/scripts/weekly_receipt.py
 bb2f134ab9b07e2cf15c4c8a0fad4708bc398144195178960d63b8ea6fd4a2d4  .claude/skills/agentic-delivery/INDEX-scripts.md
 5d66d96d22947e0528fd3f337f789d3a8445dfeeb8240b41fe28303aa5a5c8ad  .claude/skills/agentic-delivery/INDEX.md
-f06d54333a30a96e3832e54f0cb03cc0176f17147fc053105c94bdd1101a37ce  .claude/skills/agentic-delivery/SKILL.md
-eea5482cd77684430199a61baf7daf8bd18e43ad0009df2732fb35c4e28f3d38  .claude/skills/agentic-delivery/VERSION
+fa239ae429df6aa551803584e15ddf20452870bffa0c0e4e2db732cf81e2ea57  .claude/skills/agentic-delivery/SKILL.md
+11e3c4a20b52c9b6ff67b62f689ad64790a55e4bb9743260025179320c23aa9b  .claude/skills/agentic-delivery/VERSION
 94144c101f82399eb6c18f688321a00e1c195dd0ab334f3a5daa2543b40ff9f5  .claude/skills/agentic-delivery/evals/evals.json
 fba7699a2d0836b51b7c838d019b1f0cd20570522a362e8a32b8dacfb911298e  .claude/skills/agentic-delivery/evals/triggers.json
 39140ac0b40907dc2279bb3234ce1d8ffb4db56e8658c7f89cc370f777df0592  .claude/skills/agentic-delivery/references/cost-quality-guardrails.md
@@ -204,8 +204,8 @@ d98f3e4380da3496061ba63be7beebe75017ab4ee1734eda9a3e798e19007b0e  .claude/skills
 18f20db537ab784460ad33cf218f7a01ac0a172fc38413f14c0e19e1ce6821cc  .claude/skills/contribution/scripts/share_learning.py
 e2c5a8031dd78e97703fa9cf9b946f650721c6d4b56f57ae5726dd1d1d96260d  .claude/skills/deep-code-review/INDEX-scripts.md
 533bb3d58e6319f9b2a33e6b0f13212fc320c82b0164dd19612c32d274746ca5  .claude/skills/deep-code-review/INDEX.md
-00968df8b870e8d9a8ab223d0efa926ad4d527ed308c604b1087af9652a27f5d  .claude/skills/deep-code-review/SKILL.md
-eea5482cd77684430199a61baf7daf8bd18e43ad0009df2732fb35c4e28f3d38  .claude/skills/deep-code-review/VERSION
+f7b6bb4c7b22d75df66ac9c63285a148f790f4d28e28e5e762448a2dcaf84df4  .claude/skills/deep-code-review/SKILL.md
+11e3c4a20b52c9b6ff67b62f689ad64790a55e4bb9743260025179320c23aa9b  .claude/skills/deep-code-review/VERSION
 dffc2f49183ea895a27d503ecf0538bfa5dd18a60824f86e886b512bc6282d92  .claude/skills/deep-code-review/evals/evals.json
 13dbb52e4bf61b1093302e094151def167371d26e7cf67a026f3beeb09d34378  .claude/skills/deep-code-review/evals/triggers.json
 b84e3a2b88dc189f041784e76b97e68ad879915814e00f4b37cd27513746d6f1  .claude/skills/deep-code-review/references/a11y-aria.md
@@ -419,8 +419,8 @@ e951eaa63fd0d1870701d69c89c29ef4fe74dbad9b680ab6ef0a4e993fb8bc20  .claude/skills
 fd316c63bbf1cc0ea64322d7d923d66692eaf7b545c056367bfecca35146c862  .claude/skills/growth-analytics/references/full-map.md
 2f1d7499e9ed7ae59f550b5c00043e465b2a4e885821ad153438e2e33fcccb45  .claude/skills/growth-analytics/scripts/readout_check.py
 67e71ec40535ad0b3931c51f3decf323bce809ed4c9586c6d422b7ad5698129f  .claude/skills/idea-critic/INDEX.md
-edd6c254cb4ceaf00b3171439eaacf225cde74b921e96c9e829cb892008aa092  .claude/skills/idea-critic/SKILL.md
-eea5482cd77684430199a61baf7daf8bd18e43ad0009df2732fb35c4e28f3d38  .claude/skills/idea-critic/VERSION
+10b8080a8dfa83836cbfa88255f17b37626df9942618717cc3f35641d3377dc7  .claude/skills/idea-critic/SKILL.md
+11e3c4a20b52c9b6ff67b62f689ad64790a55e4bb9743260025179320c23aa9b  .claude/skills/idea-critic/VERSION
 9f77d5d6d13c99fd16cd8c398795d8be226d74bae5a5bf65369ed94a59fa56b7  .claude/skills/idea-critic/evals/evals.json
 0e1c0db300661a1ab1a427a7157c75e2ed67130ab24d5c6cb02ec3ff9e793f58  .claude/skills/idea-critic/evals/heldout.json
 d8098c5ced63e8b8608867dd144091049563a0553cf62d27ce05b9d52ac54266  .claude/skills/idea-critic/evals/triggers.json

diff --git a/changelog.d/rules-gate-locale.md b/changelog.d/rules-gate-locale.md
diff --git a/changelog.d/tests-wired.md b/changelog.d/tests-wired.md
diff --git a/changelog.d/veche-surface-leftovers.md b/changelog.d/veche-surface-leftovers.md
diff --git a/changelog.d/w6-review-fixes.md b/changelog.d/w6-review-fixes.md
diff --git a/changelog.d/w6a-review-blues.md b/changelog.d/w6a-review-blues.md
diff --git a/gemini-extension.json b/gemini-extension.json
@@ -1,6 +1,6 @@
 {
   "name": "perun",
-  "version": "1.622.0",
+  "version": "1.623.0",
   "description": "Perun: a skill suite for AI-agent teams: deep code review, token and cost tools, gated delivery, an idea critic and product specialists.",
   "contextFileName": "AGENTS.md"
 }