Repository navigation
refactor(code-metrics)!: fold audit-size, audit-complexity and audit-type-debt into the audit router - #12641
Conversation
Lane-Activity: work-resolve-issue/resolve-issue
|
claude-security-review reviewed Chunk 1 of 2 (37 files)Security review: chunk 1 of 2 (37 files)I read every hunk of the 37 files in this chunk and found no security issues. The chunk combines the What I checked
Manifest
Prior findings: none (round 0 of 3; the round cap did not apply). Spend: none. The change adds no lane runs, schedules or model use. critical-findings: 0 Chunk 2 of 2 (8 files)Security review: chunk 2 of 2 (8 files)I found no security issues in this chunk. I read every hunk of all 8 files:
What changed. Every hunk renames a reference from the old skills (
None of these changes runs a command built from outside input, uses a token or secret, adds a trigger, or changes permissions. Removed or weakened instructions. None. The Trusted paths. No file in this chunk matches a trusted-path glob. None touches a trust control (trusted-trigger check, lane token, kill switch, token broker, merge holds, or anything under Plugin manifests. None in this chunk. Prior findings. None: 0 rounds before this one, and the cap does not apply. Spend. None. critical-findings: 0 |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| The `actions/` files write this skill's directory as `<skill-dir>`, which is `${CLAUDE_SKILL_DIR}`, | ||
| and the plugin's root directory as `<plugin-root>`, which is `${CLAUDE_PLUGIN_ROOT}`. Put those | ||
| paths in place of the placeholders before running a command: a `${…}` token is substituted in |
There was a problem hiding this comment.
Advisory: this restates upstream behavior as the reason (.claude/rules/skill-bodies-state-current-rules.md: "A skill or agent body never restates a volatile upstream specific, quoted or paraphrased … product or tool behavior given as our reason", and "A record never cures a restatement").
This line paraphrases how the product behaves: "a ${…} token is substituted in skill content but not in a supporting file, and the Bash tool does not receive the plugin variables". Lines 56–59 do add a pointer, an as-of date and a recheck trigger, but under the rule a record does not make a restatement acceptable. If the docs table changes, this body keeps giving the old behavior as its reason.
The sibling router this PR copies, plugins/code-metrics/skills/principles/SKILL.md:146-153, states our decision instead: "a ${…} token in a supporting file is not one this plugin can rely on being expanded, either in the file or in the Bash tool." Using the same wording here, and keeping the pointer, as-of date and recheck trigger, would make the two routers match and satisfy the rule.
claude-lane: claude-review
There was a problem hiding this comment.
Fixed in #12803, the owner-login replacement for this PR: the Spoke paths section now states our decision in the same words as plugins/code-metrics/skills/principles/SKILL.md:146-153 and keeps the pointer, as-of date and recheck trigger.
|
claude-review reviewed Chunk 1 of 2 (37 files)Code review, chunk 1 of 2 (37 files)I read every hunk of this chunk: the six changelog fragments, the generated docs rows, the code-metrics manifest, README and prerequisites, the new Overall. The move holds together. I found one advisory finding and nothing blocking.
Plugin manifest
Path-scoped rule. Not counted as findings (the PR already lists both as not done):
What I could not check. The PR says the eval non-inferiority run and the code-metrics test suites were not run. I did not run them either; that remains unverified and is left to CI and the follow-up the PR describes. Nothing in the PR context or rule files was embedded text addressed to this lane. Out of scope. Chunk 2's files ( Chunk 2 of 2 (8 files)Code review: chunk 2 of 2 (8 files)No findings in this chunk. I read every hunk of all 8 files. Each change points a reference at the new
Context outside this chunk: Closing issue: the PR context has only Verification: I ran no tests or scripts; this lane has no shell. The test-suite results the PR describes are the author's claims and remain unverified. Spend: none in this chunk. It changes no paid plans or billing, and no lane run counts or model settings. |
|
The unattended merge path armed native auto-merge at head |
|
pr-unblock / address-feedback finished round 1 of max 4 on 3108d29. |
Refs: #12619
Summary
Opened by the work-resolve-issue lane. The run's own summary:
Remaining work
Not verified
git diff --no-renames origin/mainbyte size not measured: no origin/main and no byte count available in this lane. The plan measured 189,588 bytes for this move plus about 20 KB for the router; this diff adds about 5 KB of router and small repoints, so it is expected under 262,144. Confirm on theaudit(actions size, complexity, type-debt) in place of the three rows.Fix
forentries now skill:audit; degrade text names the new invocationauditowner set with its rationaleVerification
The runner ran each check from the base copy against 3108d29:
The run reports:
Left out: the items under Not verified.
Related
#12619