[kyle-sexton]

No related issue: code-tidying upkeep sweep.

Summary

Replaces #12765, the lanes App's tidy of plugins/visualization/skills/present/scripts/check-deck.mjs, as an owner-login pull request. The pr-verify verifier failed #12765 only because it had no spec: it linked no issue and a lanes App body is not trusted spec text. pr-unblock's address-feedback lane could not supply one with a file change, left the fail-note thread open as UNCERTAIN, and labeled the PR needs-session. This pull request's title and body are the spec: route check-deck's K2 refusal through its local-result helper without changing the printed JSON, and list hosted in the header usage comment.

Fix

• Carries refactor(visualization): route check-deck's K2 refusal through its local-result helper #12765's change: checkDeck's local() helper builds the K2 refusal, and the header usage comment lists hosted among the --argument values, matching the parser and the printed usage line.
• local() now takes the refusal list as its one optional argument instead of an open extra object spread after the fixed keys. Both review lanes on refactor(visualization): route check-deck's K2 refusal through its local-result helper #12765 noted that the spread could overwrite medium or class; a named argument removes that.
• A test pins the K2 refusal's keys and order (medium, class, reason, refused) and checks that other refusals carry no refused key.
• .changes/visualization/ patch fragment (from refactor(visualization): route check-deck's K2 refusal through its local-result helper #12765).

Verification

• bash plugins/visualization/tests/present.test.sh: 55/55 pass.
• scripts/check-affected.sh --base origin/main --no-fetch: 13 passed, 2 skipped (no changed shell or Python).

Related

• refactor(visualization): route check-deck's K2 refusal through its local-result helper #12765, superseded by this pull request.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Vcupom3BKF6QuC5U3sRJPj

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-03T09:52:49.892561Z	d9ff164	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-security-review reviewed d9ff164f23bf6ab6af686e030c8572ee1e7484fd: read 3 of 3 changed file(s); 0 finding(s), 0 as inline comments.

Security review: PR #12806

I found no security issues in this pull request. I read every hunk of all 3 changed files.

What changed:

• plugins/visualization/skills/present/scripts/check-deck.mjs
  • The local() result helper now takes an optional refused argument by name. It adds that key after the fixed medium, class and reason keys and only when the argument is truthy.
  • The K2 refusal now goes through local(). It still exits 1 and prints the same JSON keys in the same order.
  • The header comment now lists hosted among the --argument values.
• plugins/visualization/tests/present.test.mjs adds a test that pins the key order of the K2 refusal and checks that other refusals carry no refused key.
• A .changes/ patch fragment.

Security reasoning:

• The helper takes a named argument instead of spreading an open object, so caller data can no longer overwrite medium or class. If anything this narrows the surface.
• The K2 path only calls local() when refused.length is non-zero, so the conditional spread behaves exactly like the old inline object.
• The deck-root symlink check, the K2 content refusal and the medium resolution are all unchanged.
• No file matches a trusted-path glob. The diff touches no trust control, plugin manifest, workflow or instruction surface.

Prior findings: none (0 rounds, cap 3, not past the cap).

critical-findings: 0

[github-actions]

claude-review reviewed d9ff164f23bf6ab6af686e030c8572ee1e7484fd: read 3 of 3 changed file(s); 0 finding(s), 0 as inline comments.

Code review: no findings. I read every hunk of all 3 changed files.

The PR spec (title and body; no closing issue) asks for two things: send check-deck's K2 refusal through local() without changing the printed JSON, and list hosted in the header usage comment. Both are met.

• Printed JSON unchanged. local(exit, reason, refused) builds { medium, class, reason, ...(refused && { refused }) } (check-deck.mjs#L189). For the K2 refusal this gives the same keys in the same order as the old literal (medium, class, reason, refused). The other callers pass no third argument, so ...undefined adds nothing and their output is unchanged. The refusal list is now a named argument instead of an open extra spread, so it can no longer overwrite medium or class.
• Header usage. The comment now matches the parser's --argument allowlist (L244) and the printed usage line (L250), both of which already include hosted.
• Test. The new test pins the K2 refusal's key order. Its untitled K2 deck does exercise a non-K2 path: titleRefusal returns before k2Refusals runs (L211-L215). So the test would fail if refused leaked into other refusals or the key order changed.
• Changelog fragment. bump: patch fits an internal refactor with no change in behaviour.

I did not run the tests. The 55/55 pass and the check-affected.sh results in the PR body are the author's claims and are unverified here.

There are no prior findings and no settled threads. The round cap (3) does not apply.

[melodic-automation-lanes]

Unattended merge: risk MED at head d9ff164f23bf6ab6af686e030c8572ee1e7484fd. Only LOW, or MED on class, size and reported review-finding reasons alone, merges without a human. The lanes clear its holding reasons (a size reason holds nothing); pr-merge judges it again each run.

MED evidence-unbound:claude-review: not bound: rerun-not-allowed
MED evidence-unbound:claude-security-review: not bound: rerun-not-allowed