chore(autoreview): use the shared canonical skill

[vincentkoc]

What Problem This Solves

Repository-local autoreview copies drift and can retain retired prerequisites such as TruffleHog.

User Impact

Install autoreview once from openclaw/agent-skills using the setup linked in .agents/skills/autoreview/SKILL.md. Reviews run from this repository through that shared installation. Updating its source checkout updates all symlinked consumers; copy-mode users reinstall once. Product runtime behavior is unchanged.

Why This Change Was Made

Keep only the canonical Markdown entrypoint and remove the copied helper, fixtures, and implementation tests.

Canonical owner and preserved downstream fixes: openclaw/agent-skills#305. Shared changes belong upstream; review runs do not download or update code automatically.

Evidence

• All 17 consumer entrypoints match the canonical template; each contains no local helper or implementation tests.
• git diff --check passes; independent integration review checked callers and removed gates.
• The shared installer and helper dry runs pass from consumer repositories without TruffleHog. Canonical regression tests and review are recorded in the upstream PR.
• Product runtime suites were not run for this shared-tooling cutover.

Landing follow-up

Repository instructions explicitly retain the original P0–P3 review gate with --max-priority P3; direct invocation examples use that override. The shared entrypoint remains identical to the canonical template.

[clawsweeper]

Codex review: blocked before merge. Reviewed October 3, 2026, 8:45 PM ET / October 4, 2026, 00:45 UTC (Revision 6).

ClawSweeper review

What this changes

Replace Gitcrawl’s copied code-review helper, harness, and tests with instructions for using the shared installation, and document the transition.

Merge readiness

⛔ Blocked before merge - 3 items remain

The consolidation remains useful: current main and v0.15.0 retain the copied implementation. No concrete introduced defect was found, but removing the documented local launch paths needs an explicit tooling-transition decision. This member-authored PR is protected from automatic closure.

Priority: P3
Reviewed head: 12f2ea30935dbd3d3608219483f39bde4b7a7d79
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused consolidation with a supported replacement path and no concrete correctness finding.
Proof confidence	🌊 off-meta tidepool	Not applicable: The ordinary contributor-proof gate does not apply to this MEMBER-authored PR, and no material authority change triggers its exception. The body reports shared-install dry runs, while source verifies the installer and consumer-working-directory contract; no execution was performed here. No stored-data contract changes.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: The ordinary contributor-proof gate does not apply to this MEMBER-authored PR, and no material authority change triggers its exception. The body reports shared-install dry runs, while source verifies the installer and consumer-working-directory contract; no execution was performed here. No stored-data contract changes.
Evidence reviewed	9 items	Pinned introduced change: The pinned parent-to-head change replaces the skill instructions, deletes seven implementation, harness, test, and policy files, and adds an Unreleased changelog entry. No product source or workflow is changed. Current-main and release necessity: Fetched main still contains the local helper, harness, tests, and old instructions. The pinned base is tagged v0.15.0 and documents invoking the local helper. Neither establishes that this cutover has already landed. Explicit installation transition: The replacement requires installing the shared skill when missing, preserving Gitcrawl as the working directory, and reinstalling copy-mode installations after source updates. Existing launchers pointing at the deleted repository-local scripts will need operator changes.
Findings	None	None.
Security	None	None.

How this fits together

Autoreview is developer tooling that reviews selected Git changes and returns structured findings. Gitcrawl currently carries its own copy; this change directs contributors to an installation maintained by openclaw/agent-skills.

flowchart TD
  A[Contributor Git changes] --> B[Repository skill instructions]
  B --> C[Shared skill installation]
  C --> D[Helper runs from Gitcrawl]
  D --> E[Selected review engine]
  E --> F[Structured findings]

Loading

Decision needed

Question	Recommendation
Should Gitcrawl remove its documented local autoreview launch paths and require contributors to install the shared skill?	Approve the shared-installation cutover: Accept the documented installation and launcher changes, coordinating the canonical instructions with openclaw/agent-skills#305.

Why: The implementation is coherent, but accepting the operator work required by this intentional tooling break needs an explicit owner decision.

Before merge

• Resolve merge risk (P1) - Contributors using the documented repository-local helper or harness paths will lose those entrypoints and must install the shared skill and update their launchers; explicit acceptance of that tooling break is not recorded.
• Complete next step (P2) - Approve the removal of repository-local launch paths and coordinate the shared-installation instructions with the upstream rollout.
• Resolve maintainer decision - Resolve the maintainer decision shown above before merge.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Implementation and test LOC	Production +0/-9,258; tests +0/-5,386	The reduction transfers implementation and test ownership to the existing canonical skill.

Merge-risk options

Maintainer options:

1. Accept the documented tooling transition (recommended)
   Explicitly approve removing the local launch paths and coordinate the shared installation instructions before landing.
2. Keep the copy during rollout
   Pause this cutover until contributors can transition to the shared installation without conflicting setup instructions.

Technical review

Best possible solution:

Maintain one canonical helper with an approved installation transition and consistent shared-path instructions in Gitcrawl and upstream.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a tooling consolidation rather than a reported runtime bug; source confirms the local launch paths are removed.

Is this the best way to solve the issue?

Yes, reusing the existing canonical installer and helper avoids maintenance drift; the remaining choice is whether to accept the documented installation transition.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 3f4276c344af.

Labels

Label changes:

No label changes.

Label justifications:

• P3: This is developer-tooling consolidation with no changed Gitcrawl runtime behavior.
• merge-risk: 🚨 compatibility: Removing documented local launch paths requires existing contributors to install the shared skill and update launchers.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The ordinary contributor-proof gate does not apply to this MEMBER-authored PR, and no material authority change triggers its exception. The body reports shared-install dry runs, while source verifies the installer and consumer-working-directory contract; no execution was performed here. No stored-data contract changes.

Evidence

What I checked:

• Pinned introduced change: The pinned parent-to-head change replaces the skill instructions, deletes seven implementation, harness, test, and policy files, and adds an Unreleased changelog entry. No product source or workflow is changed. (.agents/skills/autoreview/SKILL.md:8, 12f2ea30935d)
• Current-main and release necessity: Fetched main still contains the local helper, harness, tests, and old instructions. The pinned base is tagged v0.15.0 and documents invoking the local helper. Neither establishes that this cutover has already landed. (.agents/skills/autoreview/SKILL.md:95, 3f4276c344af)
• Explicit installation transition: The replacement requires installing the shared skill when missing, preserving Gitcrawl as the working directory, and reinstalling copy-mode installations after source updates. Existing launchers pointing at the deleted repository-local scripts will need operator changes. (.agents/skills/autoreview/SKILL.md:13, 12f2ea30935d)
• Affirmative dependency and existing installer: The new target instructions explicitly execute this repository’s scripts/install-skills and shared autoreview helper. The inspected installer already supports the default shared location, custom destinations, symlink and copy modes, and forced replacement; a new installer is unnecessary. (scripts/install-skills:18, 24fe6f4bb084)
• Consumer working-directory boundary: The canonical helper discovers the reviewed repository from Path.cwd(), matching the replacement instructions to run it from Gitcrawl. Its documented isolation controls remain enabled, and its scanner-free policy is already intentional upstream. (skills/autoreview/scripts/autoreview:1994, 24fe6f4bb084)
• Coordinated upstream rollout: fix(autoreview): share one installation across repositories agent-skills#305 remains open and explicitly lists this consumer rollout. Its proposed repository-entrypoint template matches the target instructions, and it updates canonical examples from local paths to the shared installation. The existing installer and helper are already on upstream main. (skills/autoreview/references/repository-entrypoint.md:1, 334cc560ec49)

Likely related people:

• vincentkoc: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Record explicit acceptance of the local-launch-path removal and coordinate the upstream shared-installation instructions.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (5 earlier review cycles)

• reviewed 2026-10-02T08:49:27.728Z sha 12f2ea3 :: needs maintainer review before merge. :: none
• reviewed 2026-10-03T02:05:20.910Z sha 12f2ea3 :: needs maintainer review before merge. :: none
• reviewed 2026-10-03T07:13:29.476Z sha 12f2ea3 :: needs maintainer review before merge. :: none
• reviewed 2026-10-03T10:55:06.464Z sha 12f2ea3 :: needs maintainer review before merge. :: none
• reviewed 2026-10-03T18:21:25.157Z sha 12f2ea3 :: needs maintainer review before merge. :: none

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: chore(autoreview): use the shared canonical skill This is item 1/1 in the current shard. Shard 0/1.

This temporary status tracks the active review worker. The completed review will appear in the durable ClawSweeper review comment.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.