@open-agent-toolkit/cli 0.2.77 → 0.3.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/assets/agents/oat-phase-implementer.md +5 -5
- package/assets/agents/oat-reviewer.md +15 -15
- package/assets/agents/recon-worker.md +12 -12
- package/assets/bundle-metadata.json +1 -1
- package/assets/docs/cli-utilities/workflow-gates.md +1 -1
- package/assets/docs/workflows/projects/artifacts.md +2 -2
- package/assets/docs/workflows/projects/autonomy.md +1 -1
- package/assets/docs/workflows/projects/implementation-execution.md +4 -4
- package/assets/docs/workflows/projects/lifecycle.md +1 -1
- package/assets/docs/workflows/projects/reviews.md +11 -11
- package/assets/docs/workflows/skills/recon.md +53 -27
- package/assets/public-package-versions.json +4 -4
- package/assets/skills/oat-agent-instructions-analyze/SKILL.md +3 -3
- package/assets/skills/oat-docs-analyze/SKILL.md +3 -3
- package/assets/skills/oat-project-autonomous/SKILL.md +2 -2
- package/assets/skills/oat-project-autonomous/references/gate-inventory.md +14 -14
- package/assets/skills/oat-project-design/SKILL.md +2 -2
- package/assets/skills/oat-project-discover/SKILL.md +2 -2
- package/assets/skills/oat-project-document/SKILL.md +1 -1
- package/assets/skills/oat-project-document/references/docs/autonomy-contract.md +14 -14
- package/assets/skills/oat-project-implement/SKILL.md +2 -2
- package/assets/skills/oat-project-implement/references/completion-and-closeout.md +1 -1
- package/assets/skills/oat-project-implement/references/docs/autonomy-contract.md +14 -14
- package/assets/skills/oat-project-implement/references/phase-execution.md +3 -3
- package/assets/skills/oat-project-implement/references/plan-and-resume.md +2 -2
- package/assets/skills/oat-project-import-plan/SKILL.md +2 -2
- package/assets/skills/oat-project-lite/SKILL.md +1 -1
- package/assets/skills/oat-project-lite/references/docs/autonomy-contract.md +14 -14
- package/assets/skills/oat-project-plan/SKILL.md +2 -2
- package/assets/skills/oat-project-plan-writing/SKILL.md +4 -4
- package/assets/skills/oat-project-pr-final/SKILL.md +1 -1
- package/assets/skills/oat-project-pr-final/references/docs/autonomy-contract.md +14 -14
- package/assets/skills/oat-project-quick-start/SKILL.md +2 -2
- package/assets/skills/oat-project-quick-start/references/docs/autonomy-contract.md +14 -14
- package/assets/skills/oat-project-review-provide/SKILL.md +14 -14
- package/assets/skills/oat-project-review-provide-remote/SKILL.md +10 -10
- package/assets/skills/oat-project-review-receive/SKILL.md +64 -45
- package/assets/skills/oat-project-review-receive-remote/SKILL.md +6 -6
- package/assets/skills/oat-project-revise/SKILL.md +2 -2
- package/assets/skills/oat-review-provide/SKILL.md +2 -2
- package/assets/skills/oat-review-provide/references/review-artifact-template.md +3 -3
- package/assets/skills/oat-review-provide-remote/SKILL.md +11 -11
- package/assets/skills/oat-review-receive/SKILL.md +18 -17
- package/assets/skills/oat-review-receive-remote/SKILL.md +13 -13
- package/assets/skills/oat-wave-execute/SKILL.md +2 -2
- package/assets/skills/recon/SKILL.md +37 -19
- package/assets/skills/recon/references/packet-contract.md +33 -30
- package/assets/skills/recon/references/profiles.md +18 -15
- package/assets/skills/recon/references/worker-contract.md +87 -7
- package/assets/skills/recon/scripts/create-review-brief.mjs +2 -25
- package/assets/skills/recon/scripts/lib/cli-entry.mjs +21 -0
- package/assets/skills/recon/scripts/lib/contracts.mjs +144 -38
- package/assets/skills/recon/scripts/lib/routing.mjs +2 -5
- package/assets/skills/recon/scripts/lib/validated-run.mjs +1 -1
- package/assets/skills/recon/scripts/prepare-routing.mjs +2 -26
- package/assets/skills/recon/scripts/reconcile-ledger.mjs +269 -2
- package/assets/skills/recon/scripts/render-packet.mjs +2 -25
- package/assets/skills/recon/scripts/validate-artifact.mjs +2 -25
- package/assets/skills/recon/scripts/validate-packet.mjs +73 -43
- package/assets/templates/plan.md +1 -1
- package/dist/commands/gate/__fixtures__/fake-runtime.mjs +4 -4
- package/dist/commands/gate/index.d.ts.map +1 -1
- package/dist/commands/gate/index.js +20 -11
- package/dist/commands/gate/review-verdict.d.ts +2 -2
- package/dist/commands/gate/review-verdict.d.ts.map +1 -1
- package/dist/commands/gate/review-verdict.js +223 -57
- package/dist/review-remote/body-builder.d.ts +3 -3
- package/dist/review-remote/body-builder.d.ts.map +1 -1
- package/dist/review-remote/body-builder.js +12 -12
- package/dist/review-remote/reviewer-dispatch.d.ts +2 -2
- package/dist/review-remote/reviewer-dispatch.d.ts.map +1 -1
- package/dist/review-remote/reviewer-dispatch.js +15 -7
- package/package.json +2 -2
|
@@ -5,7 +5,7 @@ disable-model-invocation: true
|
|
|
5
5
|
user-invocable: true
|
|
6
6
|
allowed-tools: Read, Write, Bash, Glob, Grep, Task, AskUserQuestion
|
|
7
7
|
metadata:
|
|
8
|
-
version: 1.1.
|
|
8
|
+
version: 1.1.7
|
|
9
9
|
---
|
|
10
10
|
|
|
11
11
|
# Remote Review Provide (Project-Scoped GitHub PR)
|
|
@@ -101,8 +101,8 @@ Normalize every finding to this shape (matches the `oat-reviewer` `StructuredFin
|
|
|
101
101
|
|
|
102
102
|
```yaml
|
|
103
103
|
finding:
|
|
104
|
-
id: "C1" | "
|
|
105
|
-
severity: critical |
|
|
104
|
+
id: "C1" | "H1" | "M1" | "L1"
|
|
105
|
+
severity: critical | high | medium | low
|
|
106
106
|
title: string
|
|
107
107
|
file: string | null
|
|
108
108
|
line: number | null
|
|
@@ -113,9 +113,9 @@ finding:
|
|
|
113
113
|
Severity conventions:
|
|
114
114
|
|
|
115
115
|
- `critical`: Broken behavior, security risk, or missing P0 requirement.
|
|
116
|
-
- `
|
|
116
|
+
- `high`: Missing P1 requirement, major robustness issue.
|
|
117
117
|
- `medium`: Meaningful but non-blocking quality/maintainability issue.
|
|
118
|
-
- `
|
|
118
|
+
- `low`: Cosmetic/style/documentation issue.
|
|
119
119
|
|
|
120
120
|
Before reading the canonical reviewer definition or starting a fresh-child
|
|
121
121
|
fallback, resolve the workflows-owned role locally. Probe candidates in this
|
|
@@ -277,7 +277,7 @@ Classification is reporting-only: `empty`, `bookkeeping-only`, and `substantive`
|
|
|
277
277
|
|
|
278
278
|
### Step 5: Run the Review (Tier 1/2/3 Dispatch)
|
|
279
279
|
|
|
280
|
-
Mode-aware review against the project artifacts + the `oat-reviewer` checklist + severity model. Scope to the narrowing range when one was chosen; otherwise the full PR diff. Assign finding IDs per severity bucket (`C1`, `
|
|
280
|
+
Mode-aware review against the project artifacts + the `oat-reviewer` checklist + severity model. Scope to the narrowing range when one was chosen; otherwise the full PR diff. Assign finding IDs per severity bucket (`C1`, `H1`, `M1`, `L1`), stable within the dispatch.
|
|
281
281
|
|
|
282
282
|
**Step 5.0: Resolve and report the exact reviewer target.** Before capability
|
|
283
283
|
probing, run:
|
|
@@ -391,7 +391,7 @@ For each finding with non-null `file` + `line`, classify it against the PR diff
|
|
|
391
391
|
|
|
392
392
|
### Step 7: Build the Review Body + Verdict
|
|
393
393
|
|
|
394
|
-
Build the posted-review body with project markers (design.md → Data Models → Posted-review-body; mirrors `packages/cli/src/review-remote/body-builder.ts`): a leading HTML-comment marker block, then summary, severity counts, the
|
|
394
|
+
Build the posted-review body with project markers (design.md → Data Models → Posted-review-body; mirrors `packages/cli/src/review-remote/body-builder.ts`): a leading HTML-comment marker block, then summary, severity counts, the low-fix "Notes" nudge (only when low findings are present), and the verification commands.
|
|
395
395
|
|
|
396
396
|
Markers (project rail — both `oat_project` and `oat_review_scope` present):
|
|
397
397
|
|
|
@@ -406,7 +406,7 @@ oat_gate_target: <exact configured gate target; omit for lifecycle>
|
|
|
406
406
|
-->
|
|
407
407
|
```
|
|
408
408
|
|
|
409
|
-
`oat_project` carries the resolved project path so machine A's `oat-project-review-receive-remote` routes findings into the right project's plan tasks. Preserve the current invocation lineage in the GitHub marker: omit `oat_gate_target` for lifecycle reviews and include the exact target for gate reviews. Verdict: `REQUEST_CHANGES` when any critical or
|
|
409
|
+
`oat_project` carries the resolved project path so machine A's `oat-project-review-receive-remote` routes findings into the right project's plan tasks. Preserve the current invocation lineage in the GitHub marker: omit `oat_gate_target` for lifecycle reviews and include the exact target for gate reviews. Verdict: `REQUEST_CHANGES` when any critical or high finding exists; `COMMENT` otherwise (including a clean, zero-findings review — never auto-`APPROVE`).
|
|
410
410
|
|
|
411
411
|
### Step 8: Post the Review + Clean Up
|
|
412
412
|
|
|
@@ -493,8 +493,8 @@ At completion, report:
|
|
|
493
493
|
dispatch unavailability or explicit pre-start native role rejection.
|
|
494
494
|
- Findings produced with consistent 4-tier severities and file:line references.
|
|
495
495
|
- Inline comments mapped to in-diff positions; out-of-diff findings downgraded to the body, never dropped.
|
|
496
|
-
- Posted-review body carries the marker block first (with `oat_project` + `oat_review_scope`), correct severity counts, and the
|
|
497
|
-
- Verdict matches the C/
|
|
496
|
+
- Posted-review body carries the marker block first (with `oat_project` + `oat_review_scope`), correct severity counts, and the low-fix nudge when low findings are present.
|
|
497
|
+
- Verdict matches the C/H rule (`REQUEST_CHANGES` vs `COMMENT`; never auto-`APPROVE`).
|
|
498
498
|
- Single PR review posted (with user confirmation) via `agent-reviews` if supported, else `gh api`.
|
|
499
499
|
- Ephemeral worktree removed on success and on failure.
|
|
500
500
|
- No local artifact, no `plan.md` / `state.md` / `implementation.md` updates, no commits, no pushes on this machine.
|
|
@@ -5,7 +5,7 @@ disable-model-invocation: false
|
|
|
5
5
|
user-invocable: true
|
|
6
6
|
allowed-tools: Read, Write, Bash(git:*), Bash(oat:*), Glob, Grep, AskUserQuestion
|
|
7
7
|
metadata:
|
|
8
|
-
version: 1.6.
|
|
8
|
+
version: 1.6.7
|
|
9
9
|
---
|
|
10
10
|
|
|
11
11
|
# Receive Review
|
|
@@ -201,6 +201,25 @@ identity and destination. Resolve them here, before writing plan,
|
|
|
201
201
|
implementation, or artifact-review references. Never choose a different
|
|
202
202
|
basename later in either receive path.
|
|
203
203
|
|
|
204
|
+
### Step 1.5: Reject Retired Severity Artifacts (Fail Closed)
|
|
205
|
+
|
|
206
|
+
Before parsing findings, deriving counts, selecting a handling mode, or making
|
|
207
|
+
any lifecycle mutation, scan the selected review artifact for the retired
|
|
208
|
+
severity vocabulary. Reject the artifact when it contains any of:
|
|
209
|
+
|
|
210
|
+
- `### Important` or `### Minor` severity headings (case-insensitive);
|
|
211
|
+
- `oat_review_important_count` or `oat_review_minor_count` frontmatter keys;
|
|
212
|
+
- a legacy `Findings:` count line that reports `important` or `minor` counts.
|
|
213
|
+
|
|
214
|
+
Stop immediately when any retired form is present. Do not treat an unread
|
|
215
|
+
retired heading or count as absent or zero, do not enter the
|
|
216
|
+
`Critical + High + Medium == 0` pass path, and do not update or archive project
|
|
217
|
+
artifacts. Report which retired forms were found and direct the user to rename
|
|
218
|
+
`Important` to `High`, `Minor` to `Low`, and the matching count keys, or to
|
|
219
|
+
re-run `oat-project-review-provide` so it emits a current artifact. If a fresh
|
|
220
|
+
review still emits retired tiers, run `oat tools update` to refresh the
|
|
221
|
+
installed tools and provider projections, then re-run the review.
|
|
222
|
+
|
|
204
223
|
### Step 2: Parse Findings into Buckets
|
|
205
224
|
|
|
206
225
|
Extract findings from the review artifact and categorize:
|
|
@@ -212,7 +231,7 @@ Extract findings from the review artifact and categorize:
|
|
|
212
231
|
- Broken functionality
|
|
213
232
|
- Missing tests for critical paths
|
|
214
233
|
|
|
215
|
-
**
|
|
234
|
+
**High (should fix before merge):**
|
|
216
235
|
|
|
217
236
|
- Missing P1 requirements
|
|
218
237
|
- Missing error handling
|
|
@@ -224,7 +243,7 @@ Extract findings from the review artifact and categorize:
|
|
|
224
243
|
- Moderate maintainability/testability issues
|
|
225
244
|
- Contract gaps that can cause future regressions
|
|
226
245
|
|
|
227
|
-
**
|
|
246
|
+
**Low (fix if time permits):**
|
|
228
247
|
|
|
229
248
|
- Cosmetic/non-behavioral polish
|
|
230
249
|
- Style issues
|
|
@@ -234,17 +253,17 @@ Extract findings from the review artifact and categorize:
|
|
|
234
253
|
|
|
235
254
|
```
|
|
236
255
|
Critical: {N}
|
|
237
|
-
|
|
256
|
+
High: {N}
|
|
238
257
|
Medium: {N}
|
|
239
|
-
|
|
258
|
+
Low: {N}
|
|
240
259
|
```
|
|
241
260
|
|
|
242
261
|
Assign stable finding IDs for this receive run and keep them consistent in all prompts:
|
|
243
262
|
|
|
244
263
|
- Critical: `C1`, `C2`, ...
|
|
245
|
-
-
|
|
264
|
+
- High: `H1`, `H2`, ...
|
|
246
265
|
- Medium: `M1`, `M2`, ...
|
|
247
|
-
-
|
|
266
|
+
- Low: `L1`, `L2`, ...
|
|
248
267
|
|
|
249
268
|
For each finding, build a structured register entry:
|
|
250
269
|
|
|
@@ -262,17 +281,17 @@ For each finding, build a structured register entry:
|
|
|
262
281
|
- `rejected_with_rationale` (invalid/not applicable)
|
|
263
282
|
- `needs_user_direction` (unclear or disagreement)
|
|
264
283
|
|
|
265
|
-
**If Critical +
|
|
284
|
+
**If Critical + High + Medium == 0:**
|
|
266
285
|
|
|
267
286
|
- For non-final scopes:
|
|
268
287
|
- Mark the review as `passed` in the plan.md Reviews table (if plan.md exists)
|
|
269
288
|
- No fix tasks are added
|
|
270
|
-
-
|
|
289
|
+
- Low findings still follow the Step 9 recommendation/disposition rules before routing onward
|
|
271
290
|
- Route user to normal next action
|
|
272
291
|
- For `final` scope:
|
|
273
292
|
- Do not mark `passed` until both gates are complete:
|
|
274
293
|
1. Deferred-medium resurfacing/disposition (Step 8.5)
|
|
275
|
-
2.
|
|
294
|
+
2. Low findings disposition is explicitly confirmed by user (Step 9)
|
|
276
295
|
- After both gates are complete, mark `passed` and route to PR/finalization
|
|
277
296
|
- Note: `passed` means “review passed” (not merely “fixes completed”). If fixes exist, use `fixes_completed` until a re-review passes.
|
|
278
297
|
|
|
@@ -286,9 +305,9 @@ Required output structure:
|
|
|
286
305
|
Findings Overview:
|
|
287
306
|
|
|
288
307
|
- Critical: {N}
|
|
289
|
-
-
|
|
308
|
+
- High: {N}
|
|
290
309
|
- Medium: {N}
|
|
291
|
-
-
|
|
310
|
+
- Low: {N}
|
|
292
311
|
|
|
293
312
|
Critical Findings:
|
|
294
313
|
{for each C\* finding}
|
|
@@ -299,13 +318,13 @@ Critical Findings:
|
|
|
299
318
|
- Recommendation: {convert_to_task | defer_with_rationale}
|
|
300
319
|
- Task Scope: {Large | Moderate | Minor | Negligible}
|
|
301
320
|
|
|
302
|
-
|
|
321
|
+
High Findings:
|
|
303
322
|
{same pattern}
|
|
304
323
|
|
|
305
324
|
Medium Findings:
|
|
306
325
|
{same pattern}
|
|
307
326
|
|
|
308
|
-
|
|
327
|
+
Low Findings:
|
|
309
328
|
{same pattern, include fix-now vs defer-now tradeoff in plain language}
|
|
310
329
|
```
|
|
311
330
|
|
|
@@ -333,20 +352,20 @@ Read `oat_review_type` and `oat_review_invocation` from review artifact frontmat
|
|
|
333
352
|
- Do not defer findings by default. Only use `rejected_with_rationale` for invalid findings, or `needs_user_direction` when user input is required.
|
|
334
353
|
- If `oat_review_type == code` AND `oat_review_invocation == auto`, OR `oat_review_invocation == gate` from a **blocking** gate (the gate-originated context does not indicate a passing-gate sweep):
|
|
335
354
|
- **Auto-disposition mode.** This review was spawned by the auto-review checkpoint trigger in `oat-project-implement` or by a blocking `oat gate review`. Apply relaxed disposition defaults:
|
|
336
|
-
- Critical/
|
|
337
|
-
-
|
|
355
|
+
- Critical/High/Medium: convert to fix tasks (same as manual mode)
|
|
356
|
+
- Low: auto-convert to fix tasks unless clearly out of scope (e.g., cosmetic polish unrelated to changed code). Manual mode now also defaults lows to `convert` (see Step 9); auto/gate mode keeps the same intent — fix everything while context is fresh — but without any user prompts.
|
|
338
357
|
- **No user prompts for disposition decisions.** The auto/gate review path runs fully autonomously.
|
|
339
358
|
- Genuinely ambiguous findings (e.g., a medium the agent disagrees with) are deferred with a note explaining why, rather than pausing for interactive resolution.
|
|
340
359
|
- Follow the task-conversion flow in Steps 3-10 with these adjusted defaults.
|
|
341
360
|
- If `oat_review_type == code` AND `oat_review_invocation == gate` from a **passing** gate (the gate-originated context indicates a passing-gate judgment sweep):
|
|
342
361
|
- **Judgment-sweep mode.** The phase gate already passed at its `exit_nonzero_on` threshold, so the phase does not stop. Consume the artifact anyway, so its sub-threshold findings become durable, ordered dispositions in `implementation.md` instead of evaporating. Fully non-pausing; no user prompts.
|
|
343
|
-
- The gate verdict decided whether the phase stops; it did **not** decide whether Medium/
|
|
344
|
-
- Make a per-finding **judgment call** for each Medium/
|
|
362
|
+
- The gate verdict decided whether the phase stops; it did **not** decide whether Medium/Low findings are ignored. There are, by definition, no unresolved Critical/High findings in a passing gate (if there were, the gate would have blocked).
|
|
363
|
+
- Make a per-finding **judgment call** for each Medium/Low — do not mechanically dump them all:
|
|
345
364
|
- **Defer to final** (default): record under "Deferred Findings" (Mediums under "Deferred Findings (Medium)" so Step 8.5 resurfacing picks them up) with concrete rationale.
|
|
346
365
|
- **Address now:** only for small, contained, low-risk fixes. Apply the fix, commit it with the phase bookkeeping, and record the disposition. Do **not** re-run the standard reviewer or re-gate the phase for address-now fixes.
|
|
347
366
|
- **Reject** as false-positive / out-of-scope, with concrete rationale.
|
|
348
367
|
- `address now` is an **exception, not the norm** — when in doubt, defer. Do not let a passing gate drift into behaving like a Medium-blocking gate by habit.
|
|
349
|
-
- **Escalation exception:** if an address-now fix reveals or creates a Critical/
|
|
368
|
+
- **Escalation exception:** if an address-now fix reveals or creates a Critical/High concern, stop treating it as a sweep item. Convert it to a fix task and return control to the blocking-gate path (`oat-project-implement` re-runs the standard reviewer and the gate for the phase).
|
|
350
369
|
- Do not add blocking fix tasks for deferred or rejected findings. After recording all dispositions, archive the artifact (Step 7.5) and commit review bookkeeping (Step 7.6) as usual.
|
|
351
370
|
- If `oat_review_type == code` (manual or `oat_review_invocation` absent):
|
|
352
371
|
- Follow the existing task-conversion flow in Steps 3-10 with standard disposition behavior.
|
|
@@ -393,7 +412,7 @@ Derive `TASK_PREFIX` from scope:
|
|
|
393
412
|
|
|
394
413
|
### Step 5: Convert Findings to Tasks
|
|
395
414
|
|
|
396
|
-
**For each Critical,
|
|
415
|
+
**For each Critical, High, and Medium finding (default):**
|
|
397
416
|
|
|
398
417
|
Create a plan task entry:
|
|
399
418
|
|
|
@@ -475,7 +494,7 @@ Add new tasks to plan.md in the target phase. When adding or editing tasks, pres
|
|
|
475
494
|
|
|
476
495
|
- Find the existing event by `{scope}`, review Type, and
|
|
477
496
|
`$SOURCE_REVIEW_FILENAME`, then update only that row:
|
|
478
|
-
- Status: `fixes_added` (if tasks were added) or `passed` (if no Critical/
|
|
497
|
+
- Status: `fixes_added` (if tasks were added) or `passed` (if no Critical/High/Medium and no unresolved final-scope gates)
|
|
479
498
|
- Date: `{today}`
|
|
480
499
|
- Artifact: `reviews/archived/$REVIEW_FILENAME`
|
|
481
500
|
- Reviewed Head: validated full `oat_review_head_sha` for code reviews
|
|
@@ -487,7 +506,7 @@ Add new tasks to plan.md in the target phase. When adding or editing tasks, pres
|
|
|
487
506
|
|
|
488
507
|
- `fixes_added`: fix tasks were created and added to the plan
|
|
489
508
|
- `fixes_completed`: fix tasks implemented, awaiting re-review
|
|
490
|
-
- `passed`: re-review completed and recorded as passing (no unresolved Critical/
|
|
509
|
+
- `passed`: re-review completed and recorded as passing (no unresolved Critical/High/Medium, and all final-scope gates satisfied: deferred-medium + low-severity disposition)
|
|
491
510
|
- Status changes are monotonic. Never move an event status backward, replace an earlier event, or update a different event that happens to share the same scope/type.
|
|
492
511
|
|
|
493
512
|
### Step 7: Update Implementation.md
|
|
@@ -503,9 +522,9 @@ Add a note to implementation.md:
|
|
|
503
522
|
**Findings:**
|
|
504
523
|
|
|
505
524
|
- Critical: {N}
|
|
506
|
-
-
|
|
525
|
+
- High: {N}
|
|
507
526
|
- Medium: {N}
|
|
508
|
-
-
|
|
527
|
+
- Low: {N}
|
|
509
528
|
|
|
510
529
|
**New tasks added:** {task_ids}
|
|
511
530
|
|
|
@@ -630,7 +649,7 @@ Rules:
|
|
|
630
649
|
- If any deferred Medium remains undecided, final review cannot be marked `passed`.
|
|
631
650
|
- Record user decisions + rationale in `implementation.md` under the final review notes.
|
|
632
651
|
|
|
633
|
-
### Step 9: Handle Medium Deferral Requests and
|
|
652
|
+
### Step 9: Handle Medium Deferral Requests and Low Findings
|
|
634
653
|
|
|
635
654
|
Medium findings are converted to tasks by default.
|
|
636
655
|
|
|
@@ -642,43 +661,43 @@ If any Medium is proposed for deferral:
|
|
|
642
661
|
- If user declines deferral, convert that Medium to a fix task now.
|
|
643
662
|
- If user approves deferral, record rationale in `implementation.md` under "Deferred Findings (Medium)".
|
|
644
663
|
|
|
645
|
-
Design drift handling applies before Medium/
|
|
664
|
+
Design drift handling applies before Medium/Low convenience deferrals:
|
|
646
665
|
|
|
647
666
|
- If a review finding reveals that the design artifact is stale relative to a defensible implementation, do not treat this as a no-op.
|
|
648
667
|
- Either convert the finding to an artifact-alignment task or record an explicit deferral.
|
|
649
668
|
- In both cases, add an `implementation.md` review note so final summary generation can preserve the design delta.
|
|
650
669
|
- The note must include what drift was found, why the implementation is accepted, whether implementation or artifact is source of truth, and the artifact task or deferral that will align the lifecycle record.
|
|
651
670
|
|
|
652
|
-
|
|
671
|
+
Low findings handling is scope-aware:
|
|
653
672
|
|
|
654
673
|
- If `scope != final`:
|
|
655
|
-
-
|
|
656
|
-
- `defer` (and `dismiss`) at
|
|
674
|
+
- Low findings default to `convert`, not `defer`. Small findings are usually cheaper to fix inline than to track as backlog items, so converting is the baseline disposition for every Low.
|
|
675
|
+
- `defer` (and `dismiss`) at Low severity requires explicit, concrete rationale — the same gate that applies to Medium and above. Only propose deferral when the finding is genuinely low-probability cleanup, blocked by another change, duplicated elsewhere, explicitly out of scope, or fixing now would create disproportionate churn/risk.
|
|
657
676
|
- If deferred, record rationale in implementation.md under "Deferred Findings".
|
|
658
|
-
- Do not block review completion on
|
|
677
|
+
- Do not block review completion on low-severity disposition once each finding has been converted or explicitly deferred with rationale.
|
|
659
678
|
|
|
660
679
|
- If `scope == final`:
|
|
661
|
-
-
|
|
662
|
-
- Before asking for disposition, explain each
|
|
680
|
+
- Low findings are NOT auto-deferred silently.
|
|
681
|
+
- Before asking for disposition, explain each low-severity finding in plain language:
|
|
663
682
|
- what the issue is,
|
|
664
683
|
- potential user/maintainer impact,
|
|
665
684
|
- why fixing now vs deferring is reasonable.
|
|
666
685
|
- Recommendation default:
|
|
667
|
-
- default to recommending `convert` — fixing a non-blocking
|
|
686
|
+
- default to recommending `convert` — fixing a non-blocking low-severity finding inline is usually cheaper than tracking it as a backlog item, and this is especially true for `Negligible`/`Minor`-scope fixes;
|
|
668
687
|
- recommend `defer` only when the finding is unlikely to matter soon, blocked, duplicated, or high-churn to address now, and capture that concrete rationale.
|
|
669
|
-
- Keep explanations concise (1-3 sentences per
|
|
688
|
+
- Keep explanations concise (1-3 sentences per low-severity finding) and include file/line when available.
|
|
670
689
|
- Ask user explicitly:
|
|
671
690
|
|
|
672
691
|
```
|
|
673
|
-
{N}
|
|
674
|
-
- {
|
|
675
|
-
- {
|
|
692
|
+
{N} low findings pending final disposition:
|
|
693
|
+
- {L1}: {summary} — {brief explanation}
|
|
694
|
+
- {L2}: {summary} — {brief explanation}
|
|
676
695
|
...
|
|
677
696
|
|
|
678
697
|
Options:
|
|
679
|
-
1. Defer all
|
|
680
|
-
2. Select specific
|
|
681
|
-
3. Convert all
|
|
698
|
+
1. Defer all low findings with rationale
|
|
699
|
+
2. Select specific low IDs to convert to tasks (e.g., L2,L3)
|
|
700
|
+
3. Convert all lows to tasks
|
|
682
701
|
|
|
683
702
|
Choose:
|
|
684
703
|
```
|
|
@@ -750,14 +769,14 @@ Review received for {project-name}.
|
|
|
750
769
|
|
|
751
770
|
Review: $REVIEW_FILENAME
|
|
752
771
|
Scope: {scope}
|
|
753
|
-
Findings: {N} critical, {N}
|
|
772
|
+
Findings by severity: {N} critical, {N} high, {N} medium, {N} low
|
|
754
773
|
|
|
755
774
|
Actions taken:
|
|
756
775
|
- Added {N} fix tasks to plan.md ({task_ids})
|
|
757
776
|
- Updated implementation.md with review notes
|
|
758
777
|
- Archived review artifact to `reviews/archived/$REVIEW_FILENAME`
|
|
759
778
|
- Deferred/accepted Medium findings: {N}
|
|
760
|
-
-
|
|
779
|
+
- Low findings dispositioned: {N} converted (default), {N} deferred-with-rationale (explicit user decision required for final scope)
|
|
761
780
|
- Finding disposition map: {ID -> converted|deferred|accepted + rationale summary}
|
|
762
781
|
|
|
763
782
|
Review cycle: {N} of 3
|
|
@@ -772,7 +791,7 @@ Review received for {project-name}.
|
|
|
772
791
|
|
|
773
792
|
Review: $REVIEW_FILENAME
|
|
774
793
|
Scope: {scope}
|
|
775
|
-
Findings: {N} critical, {N}
|
|
794
|
+
Findings by severity: {N} critical, {N} high, {N} medium, {N} low
|
|
776
795
|
|
|
777
796
|
Actions taken:
|
|
778
797
|
- Applied {N} artifact edits
|
|
@@ -804,7 +823,7 @@ This prevents reviewing already-approved code and focuses the reviewer on just t
|
|
|
804
823
|
- Active review artifact located and read
|
|
805
824
|
- Findings parsed and categorized
|
|
806
825
|
- Findings overview + per-finding analysis presented to user before disposition choices
|
|
807
|
-
- Fix tasks created for Critical/
|
|
826
|
+
- Fix tasks created for Critical/High/Medium findings by default
|
|
808
827
|
- Plan.md updated with new tasks
|
|
809
828
|
- Implementation.md updated with review notes
|
|
810
829
|
- Consumed review artifact archived under `reviews/archived/`
|
|
@@ -813,6 +832,6 @@ This prevents reviewing already-approved code and focuses the reviewer on just t
|
|
|
813
832
|
- Final-scope deferred Medium findings resurfaced and explicitly dispositioned
|
|
814
833
|
- User routed to next action
|
|
815
834
|
- Medium deferrals handled via explicit user approval
|
|
816
|
-
-
|
|
835
|
+
- Low findings handled (converted or deferred), with explicit user decision required for final scope
|
|
817
836
|
- For `artifact` reviews: findings are resolved directly in artifacts (or rejected with rationale if invalid), with no default deferrals
|
|
818
837
|
- For `artifact` reviews: user confirms proposed edits before they are applied
|
|
@@ -5,7 +5,7 @@ disable-model-invocation: true
|
|
|
5
5
|
user-invocable: true
|
|
6
6
|
allowed-tools: Read, Write, Bash, Glob, Grep, AskUserQuestion
|
|
7
7
|
metadata:
|
|
8
|
-
version: 1.5.
|
|
8
|
+
version: 1.5.3
|
|
9
9
|
---
|
|
10
10
|
|
|
11
11
|
# Project Remote Review Receive
|
|
@@ -70,8 +70,8 @@ Normalize findings as:
|
|
|
70
70
|
|
|
71
71
|
```yaml
|
|
72
72
|
finding:
|
|
73
|
-
id: "C1" | "
|
|
74
|
-
severity: critical |
|
|
73
|
+
id: "C1" | "H1" | "M1" | "L1"
|
|
74
|
+
severity: critical | high | medium | low
|
|
75
75
|
title: string
|
|
76
76
|
file: string | null
|
|
77
77
|
line: number | null
|
|
@@ -173,7 +173,7 @@ For each comment:
|
|
|
173
173
|
- capture `type`, `path`, `line`, `url`, and comment body.
|
|
174
174
|
- classify severity using 4-tier model.
|
|
175
175
|
- use review state (e.g., `CHANGES_REQUESTED`) as a hint, not a hard override.
|
|
176
|
-
- assign stable IDs by severity bucket (`C`, `
|
|
176
|
+
- assign stable IDs by severity bucket (`C`, `H`, `M`, `L`).
|
|
177
177
|
|
|
178
178
|
### Step 4: Present Findings Overview and Triage
|
|
179
179
|
|
|
@@ -184,11 +184,11 @@ Before prompting dispositions, print:
|
|
|
184
184
|
|
|
185
185
|
Disposition options:
|
|
186
186
|
|
|
187
|
-
- `convert` (default for critical/
|
|
187
|
+
- `convert` (default for critical/high/medium/low)
|
|
188
188
|
- `defer`
|
|
189
189
|
- `dismiss`
|
|
190
190
|
|
|
191
|
-
Require concrete rationale for `defer`/`dismiss` at any severity, including
|
|
191
|
+
Require concrete rationale for `defer`/`dismiss` at any severity, including low. Small findings are usually cheaper to fix inline than to track as backlog items, so a low `defer` must be justified just like any other deferral.
|
|
192
192
|
|
|
193
193
|
### Step 5: Convert Findings to Plan Tasks
|
|
194
194
|
|
|
@@ -5,7 +5,7 @@ disable-model-invocation: true
|
|
|
5
5
|
user-invocable: true
|
|
6
6
|
allowed-tools: Read, Write, Bash(git:*), Glob, Grep, AskUserQuestion
|
|
7
7
|
metadata:
|
|
8
|
-
version: 1.0.
|
|
8
|
+
version: 1.0.4
|
|
9
9
|
---
|
|
10
10
|
|
|
11
11
|
# Project Revise
|
|
@@ -146,7 +146,7 @@ How would you like to provide feedback?
|
|
|
146
146
|
|
|
147
147
|
Parse the user's inline feedback into discrete change items. Each distinct change becomes one task.
|
|
148
148
|
|
|
149
|
-
**No severity classification.** Unlike review-receive, inline feedback does not use Critical/
|
|
149
|
+
**No severity classification.** Unlike review-receive, inline feedback does not use Critical/High/Medium/Low triage. The user is telling us directly what to change — all items become tasks.
|
|
150
150
|
|
|
151
151
|
The agent may ask clarifying questions about ambiguous feedback.
|
|
152
152
|
|
|
@@ -6,7 +6,7 @@ disable-model-invocation: true
|
|
|
6
6
|
user-invocable: true
|
|
7
7
|
allowed-tools: Read, Write, Bash, Glob, Grep, AskUserQuestion
|
|
8
8
|
metadata:
|
|
9
|
-
version: 1.2.
|
|
9
|
+
version: 1.2.5
|
|
10
10
|
---
|
|
11
11
|
|
|
12
12
|
# Ad-Hoc Review
|
|
@@ -186,7 +186,7 @@ Set `oat_generated_at` in the artifact frontmatter to the matching full UTC time
|
|
|
186
186
|
|
|
187
187
|
Use the same severity model and checklist as project reviews:
|
|
188
188
|
|
|
189
|
-
- Critical /
|
|
189
|
+
- Critical / High / Medium / Low findings
|
|
190
190
|
- file:line references
|
|
191
191
|
- actionable fix guidance
|
|
192
192
|
- verification commands
|
|
@@ -23,7 +23,7 @@ oat_review_mode: ad_hoc
|
|
|
23
23
|
|
|
24
24
|
{2-3 sentence summary}
|
|
25
25
|
|
|
26
|
-
Findings: {N} critical, {N}
|
|
26
|
+
Findings by severity: {N} critical, {N} high, {N} medium, {N} low
|
|
27
27
|
|
|
28
28
|
## Findings
|
|
29
29
|
|
|
@@ -31,7 +31,7 @@ Findings: {N} critical, {N} important, {N} medium, {N} minor
|
|
|
31
31
|
|
|
32
32
|
{If none: "None"}
|
|
33
33
|
|
|
34
|
-
###
|
|
34
|
+
### High
|
|
35
35
|
|
|
36
36
|
{If none: "None"}
|
|
37
37
|
|
|
@@ -39,7 +39,7 @@ Findings: {N} critical, {N} important, {N} medium, {N} minor
|
|
|
39
39
|
|
|
40
40
|
{If none: "None"}
|
|
41
41
|
|
|
42
|
-
###
|
|
42
|
+
### Low
|
|
43
43
|
|
|
44
44
|
{If none: "None"}
|
|
45
45
|
|
|
@@ -5,7 +5,7 @@ disable-model-invocation: true
|
|
|
5
5
|
user-invocable: true
|
|
6
6
|
allowed-tools: Read, Write, Bash, Glob, Grep, AskUserQuestion
|
|
7
7
|
metadata:
|
|
8
|
-
version: 1.1.
|
|
8
|
+
version: 1.1.4
|
|
9
9
|
---
|
|
10
10
|
|
|
11
11
|
# Remote Review Provide (Ad-hoc GitHub PR)
|
|
@@ -88,8 +88,8 @@ Normalize every finding to this shape (matches the ad-hoc review checklist and t
|
|
|
88
88
|
|
|
89
89
|
```yaml
|
|
90
90
|
finding:
|
|
91
|
-
id: "C1" | "
|
|
92
|
-
severity: critical |
|
|
91
|
+
id: "C1" | "H1" | "M1" | "L1"
|
|
92
|
+
severity: critical | high | medium | low
|
|
93
93
|
title: string
|
|
94
94
|
file: string | null
|
|
95
95
|
line: number | null
|
|
@@ -100,9 +100,9 @@ finding:
|
|
|
100
100
|
Severity conventions:
|
|
101
101
|
|
|
102
102
|
- `critical`: Broken behavior, security risk, or missing P0 requirement.
|
|
103
|
-
- `
|
|
103
|
+
- `high`: Missing P1 requirement, major robustness issue.
|
|
104
104
|
- `medium`: Meaningful but non-blocking quality/maintainability issue.
|
|
105
|
-
- `
|
|
105
|
+
- `low`: Cosmetic/style/documentation issue.
|
|
106
106
|
|
|
107
107
|
Checklist + severity model source of truth: the `oat-review-provide` review
|
|
108
108
|
artifact template. Independently probe each required `<name>/SKILL.md` in
|
|
@@ -213,7 +213,7 @@ The shared vocabulary remains `empty`, `bookkeeping-only`, or `substantive`; `bo
|
|
|
213
213
|
|
|
214
214
|
### Step 4: Run the Review (Inline)
|
|
215
215
|
|
|
216
|
-
Review inline (no tier model — matches local `oat-review-provide`) using the ad-hoc review checklist + severity model. Scope to the narrowing range when one was chosen; otherwise the full PR diff. Assign finding IDs per severity bucket (`C1`, `
|
|
216
|
+
Review inline (no tier model — matches local `oat-review-provide`) using the ad-hoc review checklist + severity model. Scope to the narrowing range when one was chosen; otherwise the full PR diff. Assign finding IDs per severity bucket (`C1`, `H1`, `M1`, `L1`).
|
|
217
217
|
|
|
218
218
|
### Step 5: Map Inline Comments to the Diff
|
|
219
219
|
|
|
@@ -229,7 +229,7 @@ For each finding with non-null `file` + `line`, classify it against the PR diff
|
|
|
229
229
|
|
|
230
230
|
### Step 6: Build the Review Body + Verdict
|
|
231
231
|
|
|
232
|
-
Build the posted-review body (design.md → Data Models → Posted-review-body): a leading HTML-comment marker block, then summary, severity counts, the
|
|
232
|
+
Build the posted-review body (design.md → Data Models → Posted-review-body): a leading HTML-comment marker block, then summary, severity counts, the low-fix "Notes" nudge (only when low findings are present), and optional verification commands.
|
|
233
233
|
|
|
234
234
|
Markers (ad-hoc rail):
|
|
235
235
|
|
|
@@ -242,7 +242,7 @@ oat_review_invocation: manual
|
|
|
242
242
|
-->
|
|
243
243
|
```
|
|
244
244
|
|
|
245
|
-
`oat_project` is omitted entirely on the ad-hoc rail. Verdict: `REQUEST_CHANGES` when any critical or
|
|
245
|
+
`oat_project` is omitted entirely on the ad-hoc rail. Verdict: `REQUEST_CHANGES` when any critical or high finding exists; `COMMENT` otherwise (including a clean, zero-findings review — never auto-`APPROVE`).
|
|
246
246
|
|
|
247
247
|
### Step 7: Post the Review + Clean Up
|
|
248
248
|
|
|
@@ -253,7 +253,7 @@ Probe `agent-reviews` for a posting flow with a non-mutating check (`npx agent-r
|
|
|
253
253
|
|
|
254
254
|
Present the body + verdict + inline-comment count to the user and get explicit confirmation, then post a single review.
|
|
255
255
|
|
|
256
|
-
`gh api --field`/`-f`/`-F` only set top-level scalar values; they CANNOT build the nested `comments[]` array of objects the reviews endpoint requires for inline comments. Construct the complete review payload as JSON and pipe it through `--input -` instead (a heredoc or a temp JSON file both work). Each in-diff finding (from Step 5) becomes one `comments[]` entry `{ path, line, side, body }`; out-of-diff findings are NOT added here — they were already downgraded into `$REVIEW_BODY` in Step 5. `event` is the Step 6 verdict (`REQUEST_CHANGES` when any critical/
|
|
256
|
+
`gh api --field`/`-f`/`-F` only set top-level scalar values; they CANNOT build the nested `comments[]` array of objects the reviews endpoint requires for inline comments. Construct the complete review payload as JSON and pipe it through `--input -` instead (a heredoc or a temp JSON file both work). Each in-diff finding (from Step 5) becomes one `comments[]` entry `{ path, line, side, body }`; out-of-diff findings are NOT added here — they were already downgraded into `$REVIEW_BODY` in Step 5. `event` is the Step 6 verdict (`REQUEST_CHANGES` when any critical/high finding exists, else `COMMENT`). A body-only review (zero in-diff findings) uses an empty `comments` array or omits the key:
|
|
257
257
|
|
|
258
258
|
```bash
|
|
259
259
|
# Build the payload as JSON. `comments` is the in-diff findings array; jq
|
|
@@ -319,8 +319,8 @@ At completion, report:
|
|
|
319
319
|
- Narrowed ranges are classified as `empty` or `substantive` for reporting only; changed-file enumeration failure conservatively reports `substantive`.
|
|
320
320
|
- Findings produced with consistent 4-tier severities and file:line references.
|
|
321
321
|
- Inline comments mapped to in-diff positions; out-of-diff findings downgraded to the body, never dropped.
|
|
322
|
-
- Posted-review body carries the marker block first, correct severity counts, and the
|
|
323
|
-
- Verdict matches the C/
|
|
322
|
+
- Posted-review body carries the marker block first, correct severity counts, and the low-fix nudge when low findings are present.
|
|
323
|
+
- Verdict matches the C/H rule (`REQUEST_CHANGES` vs `COMMENT`; never auto-`APPROVE`).
|
|
324
324
|
- Single PR review posted (with user confirmation) via `agent-reviews` if supported, else `gh api`.
|
|
325
325
|
- Ephemeral worktree removed on success and on failure.
|
|
326
326
|
- No local artifact, no lifecycle bookkeeping, no fixes/commits/pushes on this machine.
|
|
@@ -5,7 +5,7 @@ disable-model-invocation: true
|
|
|
5
5
|
user-invocable: true
|
|
6
6
|
allowed-tools: Read, Write, Bash, Glob, Grep, AskUserQuestion
|
|
7
7
|
metadata:
|
|
8
|
-
version: 1.4.
|
|
8
|
+
version: 1.4.2
|
|
9
9
|
---
|
|
10
10
|
|
|
11
11
|
# Review Receive (Ad-hoc Local)
|
|
@@ -42,8 +42,8 @@ If you catch yourself:
|
|
|
42
42
|
|
|
43
43
|
- Editing project lifecycle docs in ad-hoc mode -> STOP and revert to task-list output only.
|
|
44
44
|
- Triaging without presenting a findings overview first -> STOP and show overview before disposition prompts.
|
|
45
|
-
- Skipping rationale when proposing deferral at any severity (including
|
|
46
|
-
- Defaulting a
|
|
45
|
+
- Skipping rationale when proposing deferral at any severity (including Low) -> STOP and collect explicit rationale.
|
|
46
|
+
- Defaulting a Low finding to `defer` instead of `convert` -> STOP; the Low default is `convert` (fix inline), and `defer` requires concrete rationale.
|
|
47
47
|
|
|
48
48
|
**Recovery:**
|
|
49
49
|
|
|
@@ -72,8 +72,8 @@ Normalize every finding to this shape:
|
|
|
72
72
|
|
|
73
73
|
```yaml
|
|
74
74
|
finding:
|
|
75
|
-
id: "C1" | "
|
|
76
|
-
severity: critical |
|
|
75
|
+
id: "C1" | "H1" | "M1" | "L1"
|
|
76
|
+
severity: critical | high | medium | low
|
|
77
77
|
title: string
|
|
78
78
|
file: string | null
|
|
79
79
|
line: number | null
|
|
@@ -86,16 +86,16 @@ finding:
|
|
|
86
86
|
Severity conventions:
|
|
87
87
|
|
|
88
88
|
- `critical`: Missing P0 requirements, security vulnerabilities, broken behavior.
|
|
89
|
-
- `
|
|
89
|
+
- `high`: Missing P1 requirements, major error-handling or maintainability gaps.
|
|
90
90
|
- `medium`: P2 issues with meaningful impact.
|
|
91
|
-
- `
|
|
91
|
+
- `low`: Low-impact polish/documentation/style issues.
|
|
92
92
|
|
|
93
93
|
ID conventions:
|
|
94
94
|
|
|
95
95
|
- Critical: `C1`, `C2`, ...
|
|
96
|
-
-
|
|
96
|
+
- High: `H1`, `H2`, ...
|
|
97
97
|
- Medium: `M1`, `M2`, ...
|
|
98
|
-
-
|
|
98
|
+
- Low: `L1`, `L2`, ...
|
|
99
99
|
|
|
100
100
|
## Process
|
|
101
101
|
|
|
@@ -132,12 +132,13 @@ Validation:
|
|
|
132
132
|
Parse by severity sections/headings using case-insensitive matching:
|
|
133
133
|
|
|
134
134
|
- `Critical`
|
|
135
|
-
- `
|
|
135
|
+
- `High`
|
|
136
136
|
- `Medium`
|
|
137
|
-
- `
|
|
137
|
+
- `Low`
|
|
138
138
|
|
|
139
139
|
Compatibility rule:
|
|
140
140
|
|
|
141
|
+
- Artifacts written before the severity rename use `### Important` and `### Minor` headings, which are no longer read — the gate rejects any artifact that still contains a retired tier, its count keys, or the legacy `Findings:` count line. Rename them to `### High` and `### Low` (and `oat_review_important_count`/`oat_review_minor_count` to `oat_review_high_count`/`oat_review_low_count`), or re-run the review. If the reviewer still writes the retired tiers, its installed instructions are stale: run `oat tools update` to refresh the installed tools and their provider projections.
|
|
141
142
|
- If artifact uses a 3-tier model (no Medium section), treat Medium as zero findings.
|
|
142
143
|
|
|
143
144
|
Extraction guidance per finding item:
|
|
@@ -163,9 +164,9 @@ Example summary:
|
|
|
163
164
|
|
|
164
165
|
```text
|
|
165
166
|
Critical: 1
|
|
166
|
-
|
|
167
|
+
High: 2
|
|
167
168
|
Medium: 1
|
|
168
|
-
|
|
169
|
+
Low: 3
|
|
169
170
|
```
|
|
170
171
|
|
|
171
172
|
If there are zero findings across all severities, output a clean result and stop.
|
|
@@ -181,14 +182,14 @@ For each finding, ask for disposition:
|
|
|
181
182
|
Default suggestions:
|
|
182
183
|
|
|
183
184
|
- Critical -> `convert`
|
|
184
|
-
-
|
|
185
|
+
- High -> `convert`
|
|
185
186
|
- Medium -> `convert` (propose `defer` only with concrete rationale)
|
|
186
|
-
-
|
|
187
|
+
- Low -> `convert` (propose `defer` only with concrete rationale)
|
|
187
188
|
|
|
188
189
|
Rules:
|
|
189
190
|
|
|
190
|
-
- Require explicit rationale for `defer` or `dismiss` at any severity, including
|
|
191
|
-
- Do not recommend `defer` for a
|
|
191
|
+
- Require explicit rationale for `defer` or `dismiss` at any severity, including Low. Small findings are cheap to fix inline, so deferring a Low into a backlog item must be justified just like any other deferral.
|
|
192
|
+
- Do not recommend `defer` for a Low finding solely because it does not impact current functionality — fixing inline is usually cheaper than tracking it. Reserve `defer` for the genuine cases (low-probability cleanup, blocked dependency, duplicated elsewhere, explicitly out of scope, or disproportionate churn now).
|
|
192
193
|
- Do not silently skip findings.
|
|
193
194
|
|
|
194
195
|
### Step 5: Generate Task List Output
|