chore(autoreview): use the shared canonical skill

[vincentkoc]

What Problem This Solves

Repository-local autoreview copies drift and can retain retired prerequisites such as TruffleHog.

User Impact

Install autoreview once from openclaw/agent-skills using the setup linked in .agents/skills/autoreview/SKILL.md. Reviews run from this repository through that shared installation. Updating its source checkout updates all symlinked consumers; copy-mode users reinstall once. Product runtime behavior is unchanged.

Why This Change Was Made

Keep only the canonical Markdown entrypoint and remove the copied helper, fixtures, and implementation tests.

Canonical owner and preserved downstream fixes: openclaw/agent-skills#305. Shared changes belong upstream; review runs do not download or update code automatically.

Evidence

• All 17 consumer entrypoints match the canonical template; each contains no local helper or implementation tests.
• git diff --check passes; independent integration review checked callers and removed gates.
• The shared installer and helper dry runs pass from consumer repositories without TruffleHog. Canonical regression tests and review are recorded in the upstream PR.
• Product runtime suites were not run for this shared-tooling cutover.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed October 6, 2026, 2:47 PM ET / 18:47 UTC (Revision 3).

ClawSweeper review

What this changes

Replaces ClawRouter’s bundled code-review helper and tests with a shared-skill entrypoint, and documents installation, updates, and engine migration.

Merge readiness

✅ Ready for maintainer review

Keep open: current main and v0.4.0 do not implement this consolidation. The latest documentation resolves the earlier migration concerns, and no blocking introduced defect was found. The MEMBER author also excludes automatic closure.

Priority: P2
Reviewed head: f23453e7ac1becc8b1b76e84d71f98343aef293a

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	Focused consolidation with a working canonical installation path and resolved migration documentation supports normal good patch quality.
Proof confidence	🌊 off-meta tidepool	Not applicable: The MEMBER author is exempt from ordinary contributor proof. The shared helper’s repository selection and installer update behavior were inspected; upstream reports fresh and upgrade validation, but no runtime transcript was independently verified. No stored-data contract or material authorization transfer changes.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: The MEMBER author is exempt from ordinary contributor proof. The shared helper’s repository selection and installer update behavior were inspected; upstream reports fresh and upgrade validation, but no runtime transcript was independently verified. No stored-data contract or material authorization transfer changes.
Evidence reviewed	9 items	Pinned introduced changes: Inspected the introduced entrypoint and changelog changes, deleted helper boundaries, harnesses, fixtures, and test structure. All changed paths belong to review tooling or its documentation; no Worker, admin, provider, dependency, or workflow implementation changes are introduced. Review continuity: Compared the previous reviewed changelog through GitHub with the current checkout. The new entry supplies the shared helper invocation, forced copy-mode update, and migration away from Kimi. The previous review recorded no code findings. Historical local blob inspection failed with HTTP 403; GitHub contents reads supplied the relevant earlier documentation. Current-main and release necessity: Main still contains the bundled helper and its implementation tests. The skill at the supplied v0.4.0 release commit also instructs users to run the bundled implementation, so this cutover is neither already implemented nor shipped.
Findings	None	None.
Security	None	None.

How this fits together

Autoreview is developer tooling that takes Git changes and repository review requirements into a review engine and returns structured findings. This change delegates that tooling to an operator-installed canonical skill without changing ClawRouter’s request routing.

flowchart TD
  A[Repository changes] --> B[Local skill entrypoint]
  C[Repository review requirements] --> B
  B --> D[Shared skill installation]
  D --> E[Review engine]
  E --> F[Structured findings]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Removed executable copies	helper/harness -6,318 lines; tests/fixtures -5,763 lines	The large deletion consolidates implementation and validation ownership in the canonical repository.

Technical review

Best possible solution:

Keep one operator-managed canonical review installation, preserve local repository requirements, and use the documented migration for existing review commands.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is tooling consolidation rather than a single runtime bug. The old bundled path and the canonical installation contract were verified from source.

Is this the best way to solve the issue?

Yes. Reusing the existing installer and consumer-working-directory behavior removes copied implementations without creating a competing installation mechanism.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against e947a93ac20f.

Labels

Label changes:

No label changes.

Label justifications:

• P2: Shared review-tooling consolidation is a bounded operational improvement without evidence of an urgent product outage.
• merge-risk: 🚨 compatibility: Existing local script paths and Kimi workflows change; migration is documented and canonical Kimi retirement has explicit merged acceptance.
• merge-risk: 🚨 security-boundary: The shared helper adopts canonical scanner-free transmission policy, an explicitly recorded tradeoff rather than an unresolved request to remove safeguards.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The MEMBER author is exempt from ordinary contributor proof. The shared helper’s repository selection and installer update behavior were inspected; upstream reports fresh and upgrade validation, but no runtime transcript was independently verified. No stored-data contract or material authorization transfer changes.

Evidence

What I checked:

• Pinned introduced changes: Inspected the introduced entrypoint and changelog changes, deleted helper boundaries, harnesses, fixtures, and test structure. All changed paths belong to review tooling or its documentation; no Worker, admin, provider, dependency, or workflow implementation changes are introduced. (.agents/skills/autoreview/SKILL.md:8, f23453e7ac1b)
• Review continuity: Compared the previous reviewed changelog through GitHub with the current checkout. The new entry supplies the shared helper invocation, forced copy-mode update, and migration away from Kimi. The previous review recorded no code findings. Historical local blob inspection failed with HTTP 403; GitHub contents reads supplied the relevant earlier documentation. (CHANGELOG.md:5, f23453e7ac1b)
• Current-main and release necessity: Main still contains the bundled helper and its implementation tests. The skill at the supplied v0.4.0 release commit also instructs users to run the bundled implementation, so this cutover is neither already implemented nor shipped. (.agents/skills/autoreview/SKILL.md:8, e947a93ac20f)
• Affirmative canonical dependency: The target entrypoint explicitly delegates to this repository. Read its complete root and autoreview policies, skill, diagnostic reference, and installer at pinned canonical main. The existing installer supports symlinks, copies, custom targets, and --force; the helper selects the consumer repository from Path.cwd(). (skills/autoreview/scripts/autoreview:1995, 3d3034af58d4)
• Accepted scanner-free tradeoff: fix(autoreview): remove restored TruffleHog dependency agent-skills#240 is merged. Canonical policy explicitly places approved secret scanning outside autoreview and acknowledges that reviewer credential findings occur after transmission. The cutover adopts this existing policy; it does not establish pre-send screening for later shared-helper runs. (skills/autoreview/SKILL.md, b86a9121adde)
• Accepted Kimi compatibility decision: fix(autoreview): refuse Kimi without private prompt input agent-skills#294 is merged and explicitly records acceptance of retiring Kimi until private prompt transport is qualified. Canonical main refuses Kimi without launching it or silently selecting another engine. The target changelog now explains that migration. (skills/autoreview/SKILL.md, 6480f6ab50a2)

Likely related people:

• vincentkoc: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• Peter Steinberger: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (2 earlier review cycles)

• reviewed 2026-10-02T07:44:19.270Z sha 8e41eec :: needs maintainer review before merge. :: none
• reviewed 2026-10-02T08:49:29.310Z sha 5614d11 :: blocked before merge. :: none