jetpack-review-pr skill: catch cross-package version-skew fatals (class_exists → method_exists)

[dhasilva]

Fixes # N/A — post-mortem follow-up to SOCIAL-515 (the fix itself shipped in #49988).

Proposed changes

Harden the jetpack-review-pr skill so it catches the class of silent dependency bug behind SOCIAL-515 — a fatal that both human and Claude reviewers missed.

The bug: a package calls into a sibling package it does not declare in its own composer.json require (e.g. my-jetpack → SEO\Initializer), guarded only by class_exists(). On trunk every package is at the same version, so it resolves and CI passes — but standalone plugins (Social, Boost, …) each bundle their own jetpack_vendor/ copies and the autoloader loads ONE copy across all active plugins, often an older one. class_exists() then passes while a newly-added method is absent → Call to undefined method fatal. It was invisible in review because the introducing PR (#49672) added the new method and its class_exists-guarded caller in the same self-consistent diff.

• Add a Cross-package version skew check to step 4 (runs at all depths — it catches fatals): class_exists() is not a sufficient guard before a method/constant/property access on a non-required sibling; the guard must check the exact symbol (method_exists/is_callable/defined/function_exists/property_exists). Flags such a call as [blocker]. Includes a grep detection recipe and the SOCIAL-515 / MYJP-308 precedents.
• Add a row to the step-4 checks table.
• Add an upstream-direction note to the cross-project dependency step (step 5) — it previously only checked downstream consumers of a changed package, never calls into packages this project doesn't depend on.
• Add a Cross-Package Version Skew heading to the full-format report.

Skill-only change under .agents/ — no product code, no projects/ files, so no changelog entry is required.

Related product discussion/links

• SOCIAL-515 — SEO\Initializer::is_optin_available() fatal on Social 9.0.2 standalone
• MYJP-308 — same anti-pattern (Search product fatal on plugins not bundling jetpack-search)
• Introducing PR SEO: gate discoverability on an install cohort (PR #5c, JETPACK-1700) #49672, fix PR My Jetpack: guard SEO opt-in card with method_exists to prevent fatal #49988

Does this pull request change what data or activity we track or use?

No.

Testing instructions

This change is process documentation (a review skill), validated RED→GREEN against the real before/after diffs:

• Read the new Cross-package version skew check in .agents/skills/jetpack-review-pr.md (step 4).
• GREEN — run /jetpack-review-pr 49672 (the introducing PR). The review should raise a [blocker] for the class_exists-guarded SEO\Initializer::is_optin_available() call in projects/packages/my-jetpack/src/class-initializer.php, recommending method_exists.
• Regression — run /jetpack-review-pr 49988 (the fix). The review should raise no version-skew blocker on the corrected method_exists guard.
• Baseline for comparison: the same check run against the pre-PR skill misses the fatal (0/3 in testing vs. 3/3 with this change).

[github-actions]

Thank you for your PR!

When contributing to Jetpack, we have a few suggestions that can help us test and review your patch:

• ✅ Include a description of your PR changes.
  
• ✅ Add a "[Status]" label (In Progress, Needs Review, ...).
  
• ✅ Add testing instructions.
  
• ✅ Specify whether this PR includes any changes to data or privacy.
  
• ✅ Add changelog entries to affected projects
  

This comment will be updated as you work on your PR and make changes. If you think that some of those checks are not needed for your PR, please explain why you think so. Thanks for cooperation 🤖

---

Follow this PR Review Process:

1. Ensure all required checks appearing at the bottom of this PR are passing.
2. Make sure to test your changes on all platforms that it applies to. You're responsible for the quality of the code you ship.
3. You can use GitHub's Reviewers functionality to request a review.
4. When it's reviewed and merged, you will be pinged in Slack to deploy the changes to WordPress.com simple once the build is done.

If you have questions about anything, reach out in #jetpack-developers for guidance!