feat(skills): sync-advisor — measure the drift before naming the fix (v1.38.0)

.claude-plugin/marketplace.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://anthropic.com/claude-code/marketplace.schema.json",
   "name": "make-no-mistakes",
-  "version": "1.37.0",
+  "version": "1.38.0",
   "description": "The disciplined dev lifecycle \u2014 implement issues, review PRs, sync releases, test E2E, manage sessions, and stash secrets via OS-native prompts. One plugin to make no mistakes.",
   "owner": {
     "name": "Luis Andres Pena Castillo",
@@ -11,7 +11,7 @@
     {
       "name": "make-no-mistakes",
       "description": "Dev lifecycle orchestrator. Start with /make-no-mistakes:domain-driven-advisor \u2014 the canonical entry point that inspects your repo, asks a few plain-language questions, and routes you across the six-family audit engine (schema-drift, contract-drift, ddd, explicit-architecture, strangler, enforcement-hooks), then runs a premortem on the aggregated remediation plan. Also ships disciplined Linear issue execution with worktree isolation, PR review with Greptile gating, team release sync, E2E test generation/execution, test suite previewer, security pentesting, MoSCoW + RICE prioritization, cross-platform secret stash via OS-native GUI prompts (zenity / kdialog / osascript / Get-Credential), and session management. 37 commands, 11 auto-activating skills, 2 specialized agents.",
-      "version": "1.37.0",
+      "version": "1.38.0",
       "author": {
         "name": "Luis Andres Pena Castillo",
         "email": "lapc506@users.noreply.github.com"

.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "make-no-mistakes",
-  "version": "1.37.0",
+  "version": "1.38.0",
   "description": "The disciplined dev lifecycle — implement issues, review PRs, sync releases, test E2E, manage sessions, stash secrets, and enforce manifest-driven tool-call hooks. One plugin to make no mistakes.",
   "author": {
     "name": "Luis Andres Pena Castillo",

CHANGELOG.md

@@ -18,6 +18,115 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.38.0] - 2026-07-31
+
+### Changed
+- **`rebase-advisor` → `sync-advisor`, and it now measures instead of asking.**
+  The old skill was 43 lines and measured nothing: step 1 was *"Confirm the user
+  wants a full team sync"* — a question back to the user about something three
+  git commands answer. Its `description` then over-routed, triggering on
+  `"align with develop"` and `"branches are behind"` — both `git pull` cases —
+  and sending them all to `/make-no-mistakes:rebase`, which stashes every
+  worktree, rebases every local branch and auto-merges PRs. Between `git pull`
+  and that, the toolkit offered nothing, and nothing read-only at all.
+
+  **Six read-only predicates** now run before anything is named: distance
+  (`git rev-list --left-right --count`), whether a fast-forward is possible
+  (`git merge-base --is-ancestor`), a dirty tree split into staged vs unstaged,
+  untracked files that the base ref already tracks, worktrees behind, and
+  branches carrying unpushed commits. The fifth is the threshold that decides
+  between a plain pull and the team command: one branch behind is a pull;
+  several worktrees behind is what `/rebase` was built for.
+
+  **The fourth predicate is the one nothing else reports.** An untracked local
+  file at a path the ref tracks aborts the pull outright, and it is invisible
+  everywhere else — verified on a throwaway pair of repos: `git status` shows
+  only `?? newfile.txt`, distance reports a clean `0 ahead, 1 behind`, and
+  `git merge-base --is-ancestor` says a fast-forward is possible. The pull then
+  exits 1 with *"The following untracked working tree files would be
+  overwritten by merge … Please move or remove them before you merge"* — the
+  message names the user's own file and offers deletion as the remedy, which is
+  the one irreversible move available. The skill reports these by name and
+  recommends copying them out of the repo; it never recommends deleting them.
+
+  The collision check carries `--full-name -- :/` and `--full-tree` because the
+  predicate is otherwise silently wrong when run from a subdirectory, in two
+  independent ways. **Format:** without the flags both commands print
+  prefix-relative paths, and adding `--full-name` on its own is worse than
+  adding nothing — `ls-files` emits `sub/newfile.txt` while `ls-tree` emits
+  `newfile.txt`, they stop matching, and `comm -12` returns empty for a tree
+  that is about to abort the pull. **Scope:** `--full-name` changes how a path
+  prints, never which paths are considered, so without `-- :/` a collision at
+  the repo root is invisible to a run started from `sub/`. Both controls run,
+  from the repo root and from a subdirectory, with the command extracted
+  verbatim from the SKILL.md so the test cannot drift from the doc.
+
+  **It never acts.** Every fix is printed for the user to run — `git pull`,
+  `git stash`, `git rebase`, `/make-no-mistakes:rebase`. The single write is
+  `git fetch origin --quiet`, which touches remote-tracking refs and nothing
+  else, and the skill says so out loud when it runs: without it every
+  measurement is taken against a stale `origin/<base>` and reports a drift that
+  stopped being true days ago, which is the failure the skill exists to catch.
+
+  `commands/rebase.md` is untouched and stays a real destination. What changed
+  is who decides when it applies — measured, not asked.
+
+  Step 0 resolves the base ref in a bare form (`develop`, never
+  `origin/develop`) and normalises with `${BASE#origin/}` whichever branch of
+  the resolution produced it, because every predicate interpolates
+  `origin/$BASE` and a value carrying the remote becomes `origin/origin/develop`
+  — `fatal: ambiguous argument … unknown revision`, exit 128, measured. It also
+  does **not** resolve the base from `@{upstream}`: on a feature branch that is
+  the branch's own remote copy (`origin/andres/sync-advisor`), so it answers
+  "am I pushed?" — predicate 6's question — and reports `0 behind` on a branch
+  far behind the actual base. Wrong ref, not merely wrong spelling. The
+  `origin/HEAD` step is a fall-through rather than a requirement: it is
+  routinely unset (`fatal: ref refs/remotes/origin/HEAD is not a symbolic ref`,
+  observed in this repo) and the `develop`/`main`/`master`/`trunk` probe covers
+  it. Both branches of the resolution verified, each against a control that
+  fails.
+
+  **Minor and not major, decided by reading rather than by habit.** A skill
+  auto-activates on its `description`; it is not invoked by name the way a
+  command is, so a renamed `name:` changes no call site.
+  `grep -rniI "rebase.advisor" . --exclude-dir=node_modules --exclude-dir=.git
+  --exclude=CHANGELOG.md` returns nothing — no command, no doc, no other skill
+  named it. That negative is real rather than a broken search: the same grep
+  for `spike-recommend` returns 10 files, so cross-references of this shape do
+  get found when they exist.
+
+  One surface does break, and it is named here rather than folded into the
+  above: a user who typed `/make-no-mistakes:rebase-advisor` explicitly (README
+  documents that skills can be invoked that way) now gets an unknown skill. It
+  fails loudly, with the replacement one line away in the same table, and the
+  installer prunes the old file rather than leaving both live — but anyone who
+  reads that as breaking should say so on the PR.
+
+### Added
+- **`syncAdvisor.governedPaths` in `make-no-mistakes.config.json`** (see
+  `commands/make-no-mistakes.config.example.json`) — the paths whose changes
+  `sync-advisor` reports **by name**, turning "you are 12 commits behind" into
+  "three hooks changed, two of them fix defects you may be looking at right
+  now". Repo-relative prefixes, fed to
+  `git diff --name-only HEAD...origin/<base> -- <path>` (three dots, so it
+  diffs from the merge base and shows what landed on the ref rather than what
+  the user changed locally).
+
+  **No default, and the degraded path omits the line rather than guessing.**
+  With the key unset the skill still reports distance and routing and simply
+  drops the consequence section. A built-in fallback list would be wrong in
+  every repo but the one it was copied from — and it would read as measured,
+  which is worse than a missing section. The key lives in the behaviour config
+  rather than in a domain config for the reason that file's own `_boundary`
+  note gives: a preference parked in a domain config is invisible to every
+  command that does not touch that domain.
+
+  Origin (2026-07-31, as reported): a developer filed two bug reports against a
+  hook, both with clean reproductions. One was a real defect; the other
+  described behaviour fixed days earlier against a stale checkout, and nothing
+  in the report separated them. A commit count alone would not have separated
+  them either — naming the changed hooks would have.
+
 ## [1.37.0] - 2026-07-31
 
 ### Changed
@@ -840,7 +949,8 @@ installed caches) but had no representation on `main`; this release lands them.
 - Product Owner Extension (SPOPC) roadmap section in README
   ([PR #4](https://github.com/DojoCodingLabs/make-no-mistakes-toolkit/pull/4)).
 
-[Unreleased]: https://github.com/DojoCodingLabs/make-no-mistakes-toolkit/compare/v1.37.0...HEAD
+[Unreleased]: https://github.com/DojoCodingLabs/make-no-mistakes-toolkit/compare/v1.38.0...HEAD
+[1.38.0]: https://github.com/DojoCodingLabs/make-no-mistakes-toolkit/releases/tag/v1.38.0
 [1.37.0]: https://github.com/DojoCodingLabs/make-no-mistakes-toolkit/releases/tag/v1.37.0
 [1.36.0]: https://github.com/DojoCodingLabs/make-no-mistakes-toolkit/releases/tag/v1.36.0
 [1.35.0]: https://github.com/DojoCodingLabs/make-no-mistakes-toolkit/releases/tag/v1.35.0

README.md

@@ -1,6 +1,6 @@
 # make-no-mistakes
 
-**Version: 1.37.0** · [CHANGELOG](./CHANGELOG.md) · [Marketplace](https://github.com/DojoCodingLabs/make-no-mistakes-toolkit)
+**Version: 1.38.0** · [CHANGELOG](./CHANGELOG.md) · [Marketplace](https://github.com/DojoCodingLabs/make-no-mistakes-toolkit)
 
 The disciplined dev lifecycle — implement issues, review PRs, sync releases, test E2E, and manage sessions. One plugin to make no mistakes.
 
@@ -128,7 +128,7 @@ Auto-activate by context — you don't need to remember the command name.
 | [`spike-recommend`](skills/spike-recommend/SKILL.md) | Paste a Linear issue URL or ask to analyze an issue |
 | [`review-open-prs`](skills/review-open-prs/SKILL.md) | Ask about open PRs, merge readiness, or Greptile scores |
 | [`review-active-issues`](skills/review-active-issues/SKILL.md) | Ask about your Linear issues, backlog, or issue status |
-| [`rebase-advisor`](skills/rebase-advisor/SKILL.md) | Mention needing to sync branches after a release (suggests `/make-no-mistakes:rebase`) |
+| [`sync-advisor`](skills/sync-advisor/SKILL.md) | Ask "am I up to date", "is my checkout stale", or mention syncing after a release. Measures the drift with six read-only git predicates, names which **governed** files changed, and routes to the smallest fix — `git pull`, a single-branch rebase, or `/make-no-mistakes:rebase`. Never syncs anything itself |
 | [`audit-engine`](skills/audit-engine/SKILL.md) | Run any of the six repo-health audits (schema-drift, contract-drift, ddd, explicit-architecture, strangler, enforcement-hooks). Hybrid LLM-first detection + deterministic verification + cure-mapping |
 | [`domain-driven-advisor`](skills/domain-driven-advisor/SKILL.md) | Ask "which audit do I need?" / "where do I start with repo health?" — routes you to the right audit(s) and runs a premortem |
 | [`premortem`](skills/premortem/SKILL.md) | Say "premortem this", "what could kill this", "stress test this plan", "what am I missing", or "find the blind spots" on a plan/launch/decision |
@@ -262,6 +262,26 @@ The plugin reads `linear-setup.json` at your repo root for project-specific sett
 
 If no `linear-setup.json` exists, the plugin auto-detects settings from your environment (GitHub org from current repo, Linear team from MCP, etc.).
 
+Toolkit *behaviour* (as opposed to where things go) is read from an optional
+`make-no-mistakes.config.json`, also at the repo root — see
+[`commands/make-no-mistakes.config.example.json`](commands/make-no-mistakes.config.example.json)
+for every key and its default. Two consumers today: `language` / `diacritics` +
+`explain` for `/explain`, and `syncAdvisor.governedPaths` for the `sync-advisor`
+skill:
+
+```json
+{
+  "syncAdvisor": {
+    "governedPaths": [".claude/hooks/", "scripts/", ".github/workflows/"]
+  }
+}
+```
+
+Those are the directories where a stale checkout silently changes behaviour, so
+`sync-advisor` names them by file when they have moved on the base ref. The key
+has **no default** — unset, the skill reports distance and routing and omits
+that line rather than guessing at paths it cannot know.
+
 ## Verify Installation
 
 **Claude Code:**

commands/make-no-mistakes.config.example.json

@@ -14,5 +14,10 @@
     "actionables": true,
     "askUserQuestion": "when-open-decisions"
   },
-  "_explain": "Per-command overrides for /explain. `askUserQuestion` accepts 'when-open-decisions' (default — only call it if the explanation actually leaves a decision open), 'always', or 'never'. Setting 'always' is discouraged: a menu invented to satisfy the format trains the reader to ignore the menus that matter."
+  "_explain": "Per-command overrides for /explain. `askUserQuestion` accepts 'when-open-decisions' (default — only call it if the explanation actually leaves a decision open), 'always', or 'never'. Setting 'always' is discouraged: a menu invented to satisfy the format trains the reader to ignore the menus that matter.",
+
+  "syncAdvisor": {
+    "governedPaths": [".claude/hooks/", "scripts/", ".github/workflows/"]
+  },
+  "_syncAdvisor": "Paths whose changes the `sync-advisor` skill reports by name when it measures drift, so the answer is 'you are missing these three hook fixes' instead of 'you are 12 commits behind'. Repo-relative path prefixes, passed to `git diff --name-only HEAD...origin/<base> -- <path>`. No default — with this key unset the skill still reports distance and routing, and omits the consequence line rather than guessing. Guessing is the worse failure: a built-in list would be wrong in every repo but the one it was copied from, and read as measured. Set it to the directories where a stale checkout silently changes behaviour — hooks, CI workflows, scripts, migrations, lockfiles."
 }

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lapc506/make-no-mistakes",
-  "version": "1.37.0",
+  "version": "1.38.0",
   "description": "The disciplined dev lifecycle — implement issues, review PRs, sync releases, test E2E, manage sessions, stash secrets, and enforce manifest-driven tool-call hooks (no SSH+DB, no manual prod, no minified build, no secret leaks, Slack format). OpenCode + Claude Code plugin.",
   "type": "module",
   "main": "./dist/index.js",