docs: add a datasheet-aware code-review agent skill

[felipebalbi]

GitHub Copilot code review reads agent skills from .github/skills on the
head branch, and is more likely to use a skill whose directory name is
review-focused — code-review is the name it looks for. Without one it
reviews this crate as generic Rust.

The gap this closes

Copilot has already reviewed #48, #69 and #71 with no skill present. Its
comments were sound — debug_assert! versus assert!, as i16
truncation, a changelog line gone stale — but across all three reviews
there was not one citation of the datasheet and not one
supply-chain observation, including on #69, which changed the
release-plz workflow and the crates.io trusted-publishing path.

This driver's correctness is defined by SBOS663A. A reviewer that never
opens it can only check the code against taste.

What is here

docs/vendor/datasheet.txt — the TMP108 datasheet extracted with
pdftotext -layout, CRLF normalised to LF, so line numbers are stable
and register tables stay on greppable lines. Committing it means a
reviewer needs neither network access nor poppler installed, and every
citation becomes an anchor anyone can re-check with grep.

The directory is docs/vendor/ rather than a datasheet-specific path so
that application notes, errata, reference manuals or layout guides can
join it later; the skill globs docs/vendor/*.txt and treats whatever it
finds as in scope. Cargo.toml uses an include allowlist, so the
extract does not ship to crates.io.

• Source: https://www.ti.com/lit/ds/symlink/tmp108.pdf
• Revision: SBOS663A, April 2013, revised September 2019
• PDF sha256: ec086250fc4331e7fc923be62173062bbf0fccedad6894c2741b73cd1c084556

.github/skills/code-review/SKILL.md — the skill itself:

• Orient first. Read AGENTS.md, then the matching spec in
  docs/superpowers/specs/ via a topic→spec map, then tmp108.ddsl,
  then mod ops. A comment that contradicts a spec is a false positive.
• Cite, never remember. Every hardware claim carries a
  docs/vendor/<file>.txt:<line> anchor and a verbatim quote. A fact
  that is not in the extract is not asserted.
• Twenty TMP108 facts worth checking against a diff, each anchored:
  address strapping, pointer values, the 12-bit MSB-first twos-complement
  encoding, the configuration POR bytes, M1/M0 (continuous is M1 = 1
  alone, so 0b10 and 0b11 both mean continuous), the one-shot
  lifecycle, CR/HYS/POL/TM, the destructive configuration read,
  the comparator release band, limit POR values, the SMBus alert-response
  cause bit, general call, and the bus timeout.
• Repository invariants restated as things a diff can violate:
  generated src/inner.rs, blocking/async parity through mod ops, the
  async |t| { … } closure shape, exact feature gating, the pinned
  re-export list, release-plz's ownership of the version and changelog,
  README snippet extraction, and cargo-vet coverage for new
  dependencies.
• An adversarial pass on every diff, including documentation-only
  ones: build scripts, workflow privilege escalation, dependency
  provenance, lint suppression, unicode that does not render as it reads,
  and tampering with the trusted-publishing path. Findings are framed as
  risk that needs justifying in the PR, not as accusations of intent.
• Known non-findings, so deliberate choices are not filed as bugs:
  the blocking/async duplication, the generated inner.rs, the
  rust,ignore README fences, the intentional pico-de-gallo minor-version
  mismatch, the un-bumped Cargo.toml version, and the 0x7FF8 T_HIGH
  reset that contradicts Table 11 but was confirmed on silicon.

Verification

Every one of the 42 datasheet line anchors in the skill was checked to
resolve to the text it claims.

The skill was then run against three seeded diffs by a reviewing agent:

Diff	Result
Three planted datasheet violations — wrong POR_CONFIG, swapped 2 °C/4 °C hysteresis, byte-reversed t-low reset	All three caught, each with a verbatim quote and line anchor. It also derived the LE-word ↔ MSB-first-wire relationship and named the existing test that would fail.
Seven planted malicious constructs — credential-exfiltrating build.rs, pull_request_target with contents: write/id-token: write checking out PR code, forked action plus curl | sh, unsound unsafe behind #![allow(unsafe_code)], host-endian decode, a serde_jsom typosquat and a git-branch dependency, an unjustified [[trusted]] entry	All seven flagged, plus two it was not seeded for: --locked dropped from CI and a crate-wide pedantic allowance.
A correct diff adding one method to each driver type, tripping several known non-findings	Clean approve, no false positives; it explicitly recorded that leaving the version and changelog untouched is correct.

Notes for reviewers

• Copilot reads skills from the head branch, so this PR is its own test
  case — requesting a Copilot review here exercises the skill before it
  is merged.
• .github/skills/ is Copilot-specific. opencode, Claude Code and Gemini
  CLI look in .opencode/skills/, .claude/skills/ and .agents/skills/
  and will not discover this. Happy to add a copy or pointer under
  .agents/skills/ if we want the same review protocol available to
  local agents.
• No source, test or build-configuration files are touched, so the
  existing CI matrix is unaffected.

Assisted-by: opencode:claude-opus-5 [pdftotext]

[Copilot]

Copilot review overview

🟡 Changes recommended

The datasheet reproduction requires permission or a compliant alternative, and several skill-guidance corrections remain.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 3

Open (3)

• Clarify unsafe-code exception for generated bindings · New
• Verify datasheet hash before regenerating evidence · New
• Narrow example requirement to applicable public APIs · New

What changed in this PR

Adds an offline TMP108 datasheet extract and a repository-specific Copilot code-review skill.

Changes:

• Adds citation-ready vendor documentation.
• Adds hardware, repository-invariant, and supply-chain review guidance.

File	Summary
docs/​vendor/​datasheet.txt	Adds the extracted TMP108 datasheet.
.github/​skills/​code-review/​SKILL.md	Defines repository-specific review procedures and checks.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[kurtjd]

Just checking: Are we sure it's legal to have this copy here? The datasheet says:

These resources are subject to change without notice. TI grants you permission to use these resources only for development of an application that uses the TI products described in the resource. Other reproduction and display of these resources is prohibited.

Though I'm no lawyer of course so dunno.

[felipebalbi]

yup, that needs to be answered :-) Asked our lawyers for comment. Keeping it as a draft for now.

[Copilot]

Copilot review overview

🔵 Needs a closer look

Unresolved licensing/compliance and datasheet-extract integrity findings remain.

Review effort: Lite
Findings: None

Resolved since last review (3)

• Narrow example requirement to applicable public APIs
• Verify datasheet hash before regenerating evidence
• Clarify unsafe-code exception for generated bindings