chore(autoreview): use the shared canonical skill

[vincentkoc]

What Problem This Solves

Repository-local autoreview copies drift and can retain retired prerequisites such as TruffleHog.

User Impact

Install autoreview once from openclaw/agent-skills using the setup linked in .agents/skills/autoreview/SKILL.md. Reviews run from this repository through that shared installation. Updating its source checkout updates all symlinked consumers; copy-mode users reinstall once. Product runtime behavior is unchanged.

Why This Change Was Made

Keep only the canonical Markdown entrypoint and remove the copied helper, fixtures, and implementation tests.

Canonical owner and preserved downstream fixes: openclaw/agent-skills#305. Shared changes belong upstream; review runs do not download or update code automatically.

Evidence

• All 17 consumer entrypoints match the canonical template; each contains no local helper or implementation tests.
• git diff --check passes; independent integration review checked callers and removed gates.
• The shared installer and helper dry runs pass from consumer repositories without TruffleHog. Canonical regression tests and review are recorded in the upstream PR.
• Product runtime suites were not run for this shared-tooling cutover.

Landing follow-up

Repository instructions explicitly retain the original P0–P3 review gate with --max-priority P3; direct invocation examples use that override. The shared entrypoint remains identical to the canonical template.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs changes before merge. Reviewed October 6, 2026, 4:56 AM ET / 08:56 UTC (Revision 12).

ClawSweeper review

What this changes

Replace crawlkit’s copied autoreview helper and tests with instructions for using the shared installation, and add a changelog entry.

Merge readiness

⛔ Needs changes before merge - 1 item remains

This remains useful: current main still vendors the old implementation, and no introduced defect was found. The member-authored PR remains draft with confirmed merge conflicts.

Priority: P3
Reviewed head: a89790d35abd06ae2b6d59decdc7fccbbeee5489

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused consolidation supported by canonical-copy comparisons and an existing installer contract.
Proof confidence	🌊 off-meta tidepool	Not applicable: The MEMBER author is exempt from ordinary contributor proof; the body reports consumer shared-install dry runs, and source confirms the installer contract. No stored-data model or material authority boundary changes.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: The MEMBER author is exempt from ordinary contributor proof; the body reports consumer shared-install dry runs, and source confirms the installer contract. No stored-data model or material authority boundary changes.
Evidence reviewed	9 items	Pinned introduced change: The pinned merge-base-to-head change replaces the skill instructions, removes copied implementation and tests, and adds an Unreleased changelog entry. No product source, workflow, dependency manifest, or stored-data contract changes. Still necessary on main and release: Current main and the supplied latest release retain the bundled autoreview instructions. Neither implements this shared-installation cutover. Release comparison: The v0.16.6 skill still instructs developers to run the bundled helper.
Findings	None	None.
Security	None	None.

How this fits together

Autoreview is developer tooling that takes repository changes and produces structured review findings. This change directs developers to the centrally maintained helper while preserving crawlkit’s local review requirements.

flowchart TD
 A[Repository changes] --> B[Local skill entrypoint]
 B --> C{Shared skill installed?}
 C -->|No| D[Operator installs shared skill]
 D --> E[Shared review helper]
 C -->|Yes| E
 E --> F[Structured findings]

Loading

Before merge

• Complete next step (P2) - Resolve the confirmed merge conflicts while preserving current main’s changelog entries, then mark the PR ready when draft work is complete.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Canonical copies retired	6 helper and test files removed	All six match a historical upstream snapshot byte-for-byte, supporting centralized ownership without losing consumer-specific code.

Technical review

Best possible solution:

Maintain one canonical review implementation with an explicit operator installation path and repository-specific policy retained locally.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is tooling consolidation, and no discrete introduced bug was identified.

Is this the best way to solve the issue?

Yes: delegating historical canonical copies to the existing shared installation is a focused way to prevent drift; repository policy remains local.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 288e02a35fea.

Labels

Label changes:

No label changes.

Label justifications:

• P3: This consolidates developer review tooling without changing crawlkit product behavior.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The MEMBER author is exempt from ordinary contributor proof; the body reports consumer shared-install dry runs, and source confirms the installer contract. No stored-data model or material authority boundary changes.

Evidence

What I checked:

• Pinned introduced change: The pinned merge-base-to-head change replaces the skill instructions, removes copied implementation and tests, and adds an Unreleased changelog entry. No product source, workflow, dependency manifest, or stored-data contract changes. (.agents/skills/autoreview/SKILL.md:8, a89790d35abd)
• Still necessary on main and release: Current main and the supplied latest release retain the bundled autoreview instructions. Neither implements this shared-installation cutover. (.agents/skills/autoreview/SKILL.md:8, 288e02a35fea)
• Release comparison: The v0.16.6 skill still instructs developers to run the bundled helper. (.agents/skills/autoreview/SKILL.md:8, 610c54c15ab1)
• Explicit dependency and existing installer: The introduced entrypoint explicitly delegates to this repository. Its current installer supports autoreview selection, the default ~/.agents/skills target, symlink mode, and copy mode; the canonical skill and helper already exist. Applicable canonical policy was read fully. (scripts/install-skills:16, 3d3034af58d4)
• Removed copies match canonical history: A read-only byte comparison against canonical commit 4664d27da471d1cb71bebdd9845dc8a6c56d6bbe found exact matches for all six removed helper, launcher, harness, and test files. This establishes that the removed files are historical canonical copies rather than crawlkit-specific implementations. (skills/autoreview/scripts/autoreview, 4664d27da471)
• Upstream rollout context: fix(autoreview): share one installation across repositories agent-skills#305 explicitly describes this consumer rollout and reports shared-install dry runs. It remains open and draft; it is context, not merged-fix provenance. The current default branch already supplies the installer needed by this entrypoint. (334cc560ec49)

Likely related people:

• vincentkoc: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (11 earlier review cycles; latest 8 shown)

• reviewed 2026-10-03T18:22:13.697Z sha a89790d :: needs changes before merge. :: none
• reviewed 2026-10-03T23:50:00.792Z sha a89790d :: needs changes before merge. :: none
• reviewed 2026-10-04T21:53:46.365Z sha a89790d :: blocked before merge. :: none
• reviewed 2026-10-04T23:59:46.931Z sha a89790d :: needs changes before merge. :: none
• reviewed 2026-10-05T04:41:47.353Z sha a89790d :: needs changes before merge. :: none
• reviewed 2026-10-05T09:09:36.442Z sha a89790d :: needs changes before merge. :: none
• reviewed 2026-10-05T12:01:20.442Z sha a89790d :: needs changes before merge. :: none
• reviewed 2026-10-06T05:50:22.975Z sha a89790d :: needs changes before merge. :: none

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: chore(autoreview): use the shared canonical skill This is item 1/1 in the current shard. Shard 0/1.

This temporary status tracks the active review worker. The completed review will appear in the durable ClawSweeper review comment.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.