Repository navigation
docs(skills): pin shared go-guide and architecture-review - #79
Merged
Merged
Conversation
Agents and Copilot reviewed gatekeeper changes with no shared Go rules and no architecture checklist, unlike harness and boxes. Pin the go-guide and architecture-review skills from andybons/kit in skills-lock.json and install them under .agents/skills/ at the same hashes harness and boxes use. Add .github/skills/gatekeeper-architecture-review for the gatekeeper checks: proxy authentication, credential injection scope, the MITM CA, token exchange, and the library boundary. Point AGENTS.md, a new .github/copilot-instructions.md, and the Claude code-review workflow prompt at them. Verification: both installed skill files are byte-identical to the copies in harness and boxes; no Go code changed.
There was a problem hiding this comment.
🟡 Changes recommended
The authentication checklist incorrectly requires an HTTP 407 response from the Postgres protocol path.
1 open finding
What changed in this PR
Pins shared review skills and integrates them into Gatekeeper’s agent and review guidance; no Go code changes.
Changes:
- Adds locked Go and architecture review skills.
- Adds Gatekeeper-specific architecture checks.
- Updates Copilot, Claude, and agent instructions to apply them.
| File | Description |
|---|---|
skills-lock.json |
Pins shared skills. |
AGENTS.md |
References installed review guidance. |
.github/workflows/claude-code-review.yml |
Expands Claude’s review prompt. |
.github/skills/gatekeeper-architecture-review/SKILL.md |
Adds project-specific checks. |
.github/copilot-instructions.md |
Adds Copilot review instructions. |
.agents/skills/go-guide/SKILL.md |
Installs shared Go guidance. |
.agents/skills/architecture-review/SKILL.md |
Installs shared architecture guidance. |
🧠 Review effort: Balanced
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
The description held an unquoted colon, which is invalid YAML. Several questions read so that a yes was the safe answer, against the rule that a yes is a finding. The auth question applied the HTTP 407 rule to the Postgres listener, and the CA question said the key never reaches disk. Quote-free the description, write each question as a failure condition, split HTTP proxy auth from the Postgres run-token check, and describe the NewCA ca.key file mode.
Harness and boxes keep agent skills only under .agents/skills/. Move the verify skill there, content unchanged.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Gatekeeper had no shared Go rules and no architecture checklist for agents or reviewers, unlike harness (majorcontext/harness#524) and boxes (meetneptune/boxes#1596). This pins
go-guideandarchitecture-reviewfrom andybons/kit inskills-lock.jsonat the same hashes, installs them under.agents/skills/, and adds.github/skills/gatekeeper-architecture-reviewwith gatekeeper-specific checks (proxy auth 407, injection scope, MITM CA, token exchange, library boundary), written from AGENTS.md and docs/. AGENTS.md, a new.github/copilot-instructions.md, and the Claude code-review workflow prompt point at them. It also moves.claude/skills/verify/SKILL.mdto.agents/skills/verify/SKILL.md(content unchanged) because.agents/skills/is the agents protocol location, consistent with harness and boxes, which keep skills only there. The product skills underskills/are untouched; no Go code changes. The installed skill files are byte-identical to the harness and boxes copies.