feat(skills): add gates skill for verification-gate discipline - #1309
Conversation
AGENTS.md is 600+ lines and gets skimmed. The verification traps it documents have cost repeated time, so this encodes them as a contextually-triggered skill alongside the existing .claude/skills/ set. Covers the false-green traps (verify:ui exiting 0 without running a test when the heavy lock is held; a stale worktree voiding downstream results; verify:cheap stopping at the first failure; format:check being CI-required but absent from verify:cheap; piped gates masking exit codes), smallest-correct-gate selection, the run-coordinator lease protocol before installs, the provider confirmation boundary, and why third-party fix claims need ref-content verification rather than ancestry checks. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
This pull request has been ignored for the connected project Preview Branches by Supabase. |
📝 WalkthroughWalkthroughAdds repository guidance for selecting and proving verification gates, updates ChangesVerification gates guidance
Estimated code review effort: 1 (Trivial) | ~5 minutes Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 887c5e5706
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.claude/skills/gates/SKILL.md (1)
29-30: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winMake the pipeline-status instruction shell-explicit.
${PIPESTATUS[0]}is Bash-specific. State that this requires Bash, or provide the repository-standard equivalent for other supported shells so agents do not silently lose the gate’s exit status.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.claude/skills/gates/SKILL.md around lines 29 - 30, Update the pipeline-status guidance near the gate piping rule to explicitly identify ${PIPESTATUS[0]} as Bash-specific. State the required Bash context, or replace it with the repository-standard status-preserving approach for any other supported shell, while retaining the instruction to check the gate status before piping.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.claude/skills/gates/SKILL.md:
- Around line 27-28: Update the pipeline-status example in the gates skill
documentation to explicitly identify Bash as the required shell when using
${PIPESTATUS[0]}. Keep the existing scoped Prettier guidance unchanged.
---
Nitpick comments:
In @.claude/skills/gates/SKILL.md:
- Around line 29-30: Update the pipeline-status guidance near the gate piping
rule to explicitly identify ${PIPESTATUS[0]} as Bash-specific. State the
required Bash context, or replace it with the repository-standard
status-preserving approach for any other supported shell, while retaining the
instruction to check the gate status before piping.
🪄 Autofix (Beta)
❌ Autofix failed (check again to retry)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 8169888e-8d37-42b9-8ace-54d9985a41ea
📒 Files selected for processing (1)
.claude/skills/gates/SKILL.md
Squash-merged; remote branch auto-deleted. Records the CodeRabbit outcome (2 of 3 findings autofixed pre-merge, third landed in #1308) and that verify:cheap never completed past check:installed-lock-parity. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
@cursoragent resolve merge conflict |
|
Taking a look!   |
|
Note Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it. ❌ Cannot run autofix: This PR has merge conflicts. Please resolve the conflicts with the base branch and try again. Alternatively, use |
|
@cursoragent Inspect the PR and repository state, identify the root cause of every failing CI check, unresolved review comment, merge conflict, and related defect. Apply the smallest robust fix using existing project patterns and best practices, without unrelated changes. Run Bugbot and all relevant lint, type-check, test, build, and CI-equivalent commands, fix any issues found, then resolve only the review comments that are fully addressed. Summarise the root causes, changes made, validation results, and any remaining blockers. |
|
PR #1309 is cleaned up: merge conflict cleared, both review threads fixed and resolved, tip pushed at Root causes
Changes
Validation
Review threadsBoth resolved after reply: Codex Remaining
|
Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>
|
Note Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it. The branch was updated while autofix was in progress. Please try again. |
Replace the stale claim that verify:ui soft-skips green under heavy-lock contention with the real wait/timeout/exit-1 behavior, and mark PIPESTATUS as Bash-specific. Align the matching AGENTS.md evidence rule. Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>
Co-authored-by: BigSimmo <BigSimmo@users.noreply.github.com>
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.claude/skills/gates/SKILL.md:
- Around line 29-30: Update the formatting guidance in the gates skill to use
the repository-local Prettier invocation via npm exec rather than npx, while
still passing only the changed files and explicitly avoiding a whole-tree
formatting command.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 5b6ab810-1224-46d9-91e6-119d2fc7b1b2
📒 Files selected for processing (3)
.claude/skills/gates/SKILL.mdAGENTS.mddocs/branch-review-ledger.md
| `verify:cheap` can still fail CI on formatting. Run `npx prettier --write <changed files>` before | ||
| pushing — scoped to your files, never `prettier --write .`, which sweeps the whole tree. |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
file=".claude/skills/gates/SKILL.md"
echo "== line count =="
wc -l "$file"
echo
echo "== relevant excerpt =="
sed -n '1,120p' "$file" | cat -n
echo
echo "== references to prettier/npx/install/lease =="
rg -n "npx|prettier|lease|install" "$file"Repository: BigSimmo/Database
Length of output: 8116
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python3 - <<'PY'
import subprocess, sys, textwrap, json, os
# Check npm/npx help text if available, without running repository code.
for cmd in [
["npx", "--help"],
["npm", "exec", "--help"],
]:
print(f"\n== {' '.join(cmd)} ==")
try:
out = subprocess.check_output(cmd, stderr=subprocess.STDOUT, text=True, timeout=20)
print(out[:4000])
except Exception as e:
print(f"ERROR: {e}")
PYRepository: BigSimmo/Database
Length of output: 3000
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== package files mentioning prettier =="
rg -n '"prettier"|prettier' package.json package-lock.json .npmrc .claude -g 'package*.json' -g '.npmrc' -g '*.md'
echo
echo "== package.json excerpt =="
sed -n '1,220p' package.json | cat -nRepository: BigSimmo/Database
Length of output: 20641
Use a local-only Prettier invocation here. npx prettier can fall back to the registry when the binary is missing; npm exec -- prettier --write <changed files> keeps it tied to the repo dependency.
🧰 Tools
🪛 SkillSpector (2.3.11)
[warning] 29: [RP1] null: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Remediation: Pin the version: npx @scope/server@1.2.3
(MCP Rug Pull (RP1))
[warning] 42: [MP2] Context Window Stuffing: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Remediation: Implement context-window management that detects and rejects padding or stuffing attempts. Prioritize system instructions over user-injected content.
(Memory Poisoning (MP2))
[warning] 43: [MP2] Context Window Stuffing: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Remediation: Implement context-window management that detects and rejects padding or stuffing attempts. Prioritize system instructions over user-injected content.
(Memory Poisoning (MP2))
[warning] 46: [MP2] Context Window Stuffing: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Remediation: Implement context-window management that detects and rejects padding or stuffing attempts. Prioritize system instructions over user-injected content.
(Memory Poisoning (MP2))
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.claude/skills/gates/SKILL.md around lines 29 - 30, Update the formatting
guidance in the gates skill to use the repository-local Prettier invocation via
npm exec rather than npx, while still passing only the changed files and
explicitly avoiding a whole-tree formatting command.
Source: Linters/SAST tools
2 participants
Encodes this repo's verification traps as a contextually-triggered skill in
.claude/skills/, alongsideissues,handoff,newtask,prlanded, andrun-pr.AGENTS.mdis 600+ lines and gets skimmed; a skill triggers on the relevant action instead. Every trap below is one that has already cost time in this repo.Covers
verify:uiexits 0 without running a single Playwright test when another worktree holds the heavy lock; a stale worktree voids downstream results (check:installed-lock-parityfails closed for this);verify:cheapstops at the first failing check;format:checkis CI-required but absent fromverify:cheap; piping a gate totailmasks its exit code.lint/typecheck/testcannot observe a markdown-only change.Docs-only: one new
SKILL.md, no source or config touched.RAG impact: no retrieval behaviour change — documentation only, no code touched.
Checks
prettier --check .claude/skills/gates/SKILL.md— cleannpm run docs:check-links— 1287 repo path references resolve🤖 Generated with Claude Code
Summary by CodeRabbit