feat(advise): migrate-or-packageize advisories for DIY capability patterns

[kavin0x]

Summary

• Adds starlog_advise (MCP + CLI) to track DIY capability patterns and recommend MIGRATE to safe corpus libraries (e.g. Clerk/Auth0/Supabase) when they pass a facts safety gate, or PACKAGEIZE only when no safe alternative exists (WATCH below recurrence threshold).
• Introduces .starlog/patterns.json scanning/store (starlog patterns scan|list) plus starlog advise packageize scaffolding for private corpus/facts.
• Extends the auth corpus with Supabase Auth + L2 facts for migration targets, bundled playbooks, and doctor checks for the pattern store / starlog_advise handshake.

[basicScandal]

Merged — thanks @kavin0x, this is a genuinely well-structured feature. The layering (detect → safety gate → migrate/packageize/watch), the playbook fallbacks, the corpus + L2 facts additions, and the doctor wiring were all solid, and it came with real tests. 🙏

I folded in three maintainer tweaks before merge so it went in green:

1. Dropped the project context passed to runSearch. A context triggers search()'s per-candidate LLM enrichment (vs_custom/context_fit/tradeoffs), but runAdvise never reads those fields — so every advise call was paying a multi-second OpenRouter round-trip (and tokens) for output it discards, and it pushed the two integration tests past vitest's 5s default whenever a rank key was in the env. Ranking is independent of context, so advice is unchanged.

2. Fixed occurrence double-counting. The migrate/packageize branches re-called upsertPattern just to set status, but upsertPattern always increments occurrences — so each actioned advise counted the same observation twice and inflated the recurrence threshold. Switched to updatePatternStatus (status-only, no increment).

3. Updated the packed-tarball smoke test. doctor.ts's success wording became starlog_search + starlog_advise available, which the main smoke test's grep "starlog_search available" no longer matched — so it failed on a healthy install (Node 20 + 22). Pointed the grep at the new wording.

Also isolated the global pattern store behind a per-test $HOME so recurrence counts can't leak in from a developer's real ~/.starlog, and added regression guards for #1 and #2.

Full suite green (606 passing) and packed smoke 19/0 on Node 20 + 22. Nice work — looking forward to more.

[basicScandal]

@kavin0x a bit of direct feedback now that it's in — you clearly put real thought into this, so this is meant as "carry it forward," not nitpicking.

What was genuinely strong

• The core shape is right: detect → facts safety gate → migrate / packageize / watch is exactly the decision tree this should be, and the recurrence threshold before advising action is a nice touch (avoids nagging on a one-off).
• The safety gate degrading from L2 facts → manifest quality signals (with an explicit "vet with starlog_facts before adopting" note) is thoughtful — it fails safe instead of over-trusting.
• The playbook fallback chain (specific → category-fallback → hardcoded default) is a clean pattern, and you shipped real tests + corpus + L2 facts, not just code. That's the bar.
• Your inline comments explained the non-obvious choices (e.g. why ADVISE_MIN_RELEVANCE drops to 50) — that's the kind of comment that actually earns its keep.

Two things worth internalizing (they caused the red build)

1. Test hermeticity. The two failing tests reached live network/LLM because they didn't mock runSearch and relied on the ambient ~/.starlog store + whatever keys were in the shell. Your third test already had the right pattern (mock runSearch). Rule of thumb: a unit test must pass identically with keys set and unset, and must never read/write the developer's real home dir. Running the suite both ways locally would have surfaced this instantly.
2. Know what an API triggers before reusing it. Passing context to runSearch was a reasonable instinct — but that flag exists to drive an LLM enrichment pass whose output advise never consumes, so it was pure latency/cost. Similarly, updatePatternStatus already existed for status-only writes; reaching for upsertPattern is what caused the double-count. Worth a quick scan of the module's exports before adding a call.

Minor code notes (left as-is, for next time)

• assessPackageSafety in engine/advise.ts: the UNSAFE_MAINTENANCE branch is fully subsumed by the !SAFE_MAINTENANCE check right below it — both return the same verdict, so the first is dead. Harmless, just tidy.
• scanProject's known-library suppression is per-file: a repo using Clerk in one file and hand-rolled JWT in another will still flag DIY. Fine as a heuristic, but worth a comment noting the limitation.
• @acme/<category> as the packageize scope is a fine scaffold placeholder; someday deriving it from the org (or making it configurable) would be a nice follow-up.

Process: CI didn't auto-run because it's a fork PR (needs maintainer approval), so you couldn't see it was red — that's on our side, not yours. npm run typecheck && npm test && npm run build locally per CONTRIBUTING will catch the unit/type issues; the packed smoke (npm pack + scripts/smoke-test.sh) catches the tarball ones.

Really nice first contribution. If you're up for more, per CONTRIBUTING the highest-leverage thing is new capability manifests — and you've now got the safety-gate context to add strong ones. Thanks again. 🙌