chore(autoreview): use the shared canonical skill

[vincentkoc]

What Problem This Solves

Repository-local autoreview copies drift and can retain retired prerequisites such as TruffleHog.

User Impact

Install autoreview once from openclaw/agent-skills using the setup linked in .agents/skills/autoreview/SKILL.md. Reviews run from this repository through that shared installation. Updating its source checkout updates all symlinked consumers; copy-mode users reinstall once. Product runtime behavior is unchanged.

Why This Change Was Made

Keep only the canonical Markdown entrypoint and remove the copied helper, fixtures, and implementation tests. Keep the existing narrow synthetic-fixture allowlist unchanged because CI still scans Git history.

Canonical owner and preserved downstream fixes: openclaw/agent-skills#305. Shared changes belong upstream; review runs do not download or update code automatically.

Evidence

• All 17 consumer entrypoints match the canonical template; each contains no local helper or implementation tests.
• git diff --check passes; independent integration review checked callers and removed gates.
• The shared installer and helper dry runs pass from consumer repositories without TruffleHog. Canonical regression tests and review are recorded in the upstream PR.
• Product runtime suites were not run for this shared-tooling cutover.

CI initially found two history-scan matches after removing that allowlist; it is restored byte-for-byte from the base commit. The shared review helper remains scanner-free.

Landing follow-up

Repository instructions explicitly retain the original P0–P3 review gate with --max-priority P3; direct invocation examples use that override. The shared entrypoint remains identical to the canonical template.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs changes before merge. Reviewed October 6, 2026, 1:02 PM ET / 17:02 UTC (Revision 9).

ClawSweeper review

What this changes

The branch replaces Discrawl’s copied review helper and tests with instructions for using the shared autoreview installation and adds a changelog entry.

Merge readiness

⛔ Needs changes before merge - 1 item remains

The consolidation remains useful and is not implemented on the pinned main branch or latest release. No actionable defect was found; the member-authored PR remains a draft.

Priority: P3
Reviewed head: 5255393ed0c8ee70f2709add05c58d5f755ba727

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, maintainable consolidation with no supported correctness finding.
Proof confidence	🌊 off-meta tidepool	Not applicable: The MEMBER-authored tooling PR is exempt from external contributor proof; installation dry runs are reported, and no persisted-data contract changes.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: The MEMBER-authored tooling PR is exempt from external contributor proof; installation dry runs are reported, and no persisted-data contract changes.
Evidence reviewed	7 items	Pinned change and remaining necessity: The introduced delta replaces the local instructions, deletes six helper/test code files and the scoped policy file, and adds an Unreleased changelog entry. Pinned main still contains the copied implementation. Applicable scoped policy: No root or other ancestor AGENTS.md was found. The removed skill-scoped policy was read fully from the base; it identifies agent-skills as canonical and prohibits repository-local behavior variants. No maintainer notes were found. Affirmative dependency and supported installer: The changed entrypoint explicitly requires this dependency. Its current installer supports selecting autoreview, defaults to ~/.agents/skills, and supports symlink and copy installations.
Findings	None	None.
Security	None	None.

How this fits together

Autoreview checks proposed repository changes before shipping. The repository entrypoint directs operators to a shared installation, which reviews Discrawl from its working directory and returns findings.

flowchart TD
  A[Proposed repository changes] --> B[Discrawl review instructions]
  B --> C[Shared skill installed]
  C --> D[Review from Discrawl directory]
  D --> E[Structured findings]
  E --> F[Contributor verification]

Loading

Before merge

• Complete next step (P2) - Mark this draft ready for review before merge.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Copied tooling removed	helper code −9,258 lines; tests −5,386 lines	The reduction consolidates implementation and regression ownership in the canonical shared skill.

Technical review

Best possible solution:

Keep review implementation and regression coverage upstream, with Discrawl retaining a clear install/update entrypoint and its independent CI secret scanning.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a tooling consolidation, and no current product failure or introduced defect is established.

Is this the best way to solve the issue?

Yes: using the existing canonical installation avoids copied implementation drift, and the documented installer supports both symlink and copy modes.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 52470d9c7187.

Labels

Label changes:

No label changes.

Label justifications:

• P3: This is development-tooling consolidation with no Discrawl runtime change.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The MEMBER-authored tooling PR is exempt from external contributor proof; installation dry runs are reported, and no persisted-data contract changes.

Evidence

What I checked:

• Pinned change and remaining necessity: The introduced delta replaces the local instructions, deletes six helper/test code files and the scoped policy file, and adds an Unreleased changelog entry. Pinned main still contains the copied implementation. (.agents/skills/autoreview/SKILL.md:8, 5255393ed0c8)
• Applicable scoped policy: No root or other ancestor AGENTS.md was found. The removed skill-scoped policy was read fully from the base; it identifies agent-skills as canonical and prohibits repository-local behavior variants. No maintainer notes were found. (.agents/skills/autoreview/AGENTS.md:3, 52470d9c7187)
• Affirmative dependency and supported installer: The changed entrypoint explicitly requires this dependency. Its current installer supports selecting autoreview, defaults to ~/.agents/skills, and supports symlink and copy installations. (scripts/install-skills:20, 3d3034af58d4)
• Canonical contract and rollout context: The current canonical skill provides the shared helper and expressly keeps external secret scanning outside autoreview. Its root and skill-scoped policies were read fully. fix(autoreview): share one installation across repositories agent-skills#305 remains an open draft; it is rollout context, not a merged replacement for this PR. (skills/autoreview/SKILL.md, 3d3034af58d4)
• Caller and security boundary checks: The current-tree search found no surviving caller of the deleted helpers. The narrow historical fixture allowlist remains in .gitleaks.toml; the introduced files do not change workflows, permissions, package resolution, or automatic downloads. (.agents/skills/autoreview/SKILL.md:13, 5255393ed0c8)
• Prior merged area work: Git history and GitHub commit metadata identify vincentkoc as the author of the earlier canonical skill synchronization. Older follow-history traversal encountered an unavailable object, so feature introduction is not asserted. (.agents/skills/autoreview/SKILL.md, 0dc6a87cad9a)

Likely related people:

• vincentkoc: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (8 earlier review cycles)

• reviewed 2026-10-02T08:55:56.705Z sha 5255393 :: needs maintainer review before merge. :: none
• reviewed 2026-10-02T19:01:50.532Z sha 5255393 :: needs maintainer review before merge. :: none
• reviewed 2026-10-02T19:06:33.249Z sha 5255393 :: needs maintainer review before merge. :: none
• reviewed 2026-10-02T23:00:13.789Z sha 5255393 :: needs maintainer review before merge. :: none
• reviewed 2026-10-03T06:48:26.617Z sha 5255393 :: needs changes before merge. :: none
• reviewed 2026-10-03T10:55:27.837Z sha 5255393 :: needs changes before merge. :: none
• reviewed 2026-10-03T18:21:35.767Z sha 5255393 :: needs changes before merge. :: none
• reviewed 2026-10-05T23:27:22.126Z sha 5255393 :: needs changes before merge. :: none

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: chore(autoreview): use the shared canonical skill This is item 1/1 in the current shard. Shard 0/1.

This temporary status tracks the active review worker. The completed review will appear in the durable ClawSweeper review comment.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.