apiVersion: ops.aiwg.io/v1
kind: OpsCapability
metadata:
  name: t3mp3st-pr-audit-flow
  labels:
    category: maintainer
    repository: T3MP3ST
  annotations:
    blast-radius: "read-only review unless explicitly asked to post a review"
spec:
  description: Audit one T3MP3ST pull request for correctness, security, tests, and merge readiness.
  version: "0.1.0"
  inputs:
    - name: pr
      type: string
      required: true
      description: Pull request number or GitHub URL.
    - name: post_review
      type: boolean
      required: false
      default: false
      description: Whether to post the review decision to GitHub.
  outputs:
    - name: head_sha
      type: string
      description: Exact PR head SHA audited.
    - name: findings
      type: list
      description: Blocking or non-blocking review findings.
    - name: decision
      type: string
      description: approve, request-changes, comment, or hold.
  target_requirements:
    os: [linux, macos]
    capabilities: [git, gh, npm]
  agent: t3mp3st-pr-auditor
  idempotent: true
  steps:
    - name: read-pr-state
      description: Fetch PR metadata, comments, reviews, linked issues, head SHA, merge state, and CI state.
    - name: inspect-diff
      description: Compare the current head against upstream/main and identify changed ownership surfaces.
    - name: verify
      description: Run targeted checks, then broaden to typecheck, tests, or lint based on risk.
    - name: decide
      description: Produce findings-first maintainer decision with exact evidence.
  verification:
    command: "gh pr view \"$PR\" --repo elder-plinius/T3MP3ST --json headRefOid,mergeStateStatus,reviewDecision,statusCheckRollup >/dev/null"
    expect: "command exits 0"