t3mp3st/.aiwg/addons/t3mp3st-maintainer/skills/t3mp3st-pr-audit/SKILL.md

namespace, name, platforms, description, triggers, requires, ensures, commandHint

namespace	name	platforms	description	triggers	requires	ensures	commandHint
t3mp3st-maintainer	t3mp3st-pr-audit	all	Audit one T3MP3ST pull request as a maintainer, focusing on correctness, security boundaries, tests, and merge readiness.	t3mp3st pr audit audit T3MP3ST PR review T3MP3ST pull request maintainer audit PR	pr-number one pull request number or URL github elder-plinius/T3MP3ST tracker access	current-head-reviewed audit records the exact PR head SHA local-or-ci-verification relevant tests and CI status are recorded maintainer-decision approve, request changes, comment, or hold	argumentHint allowedTools model category <pr-number-or-url> [--post-review] [--no-post] Bash, Read, Grep sonnet code-review

T3MP3ST PR Audit

Use this for a single pull request before approval or merge.

Required Context

1. Read PR metadata and current head SHA.
2. Read PR body, linked issues, comments, and reviews.
3. Fetch or check out the exact head.
4. Inspect the diff against upstream/main.
5. Identify changed ownership surfaces:
   • src/server.ts, docs/index.html, auth/origin/proxy/provider code, src/llm/, src/agent/, src/arsenal/, scripts, CI, installer/docs.

Review Checklist

• Behavioral correctness: does the implementation satisfy the issue or PR claim?
• Security: no broadened auth/origin/scope/tool execution boundary without a gate.
• Local model/keyless paths: local, local-agent, codex, hosted-provider behavior remain distinct.
• UI/backend contract: browser payloads match server route expectations.
• Tests: regression tests match the failure mode and are not only static if runtime behavior changed.
• Docs: setup or operator behavior changes are documented where users see them.
• Merge readiness: current head is clean/mergeable and CI is green or equivalent local verification exists.

Recommended Verification

Use the smallest meaningful set, then broaden for shared/high-risk code:

npm run typecheck
npm test
npm run lint

For targeted changes, run focused tests first but remember this repo's test script currently runs vitest run src.

Review Decision

• Approve only when the current head SHA is verified.
• Request changes for correctness/security/test gaps.
• Comment without approval when the PR is promising but stale or missing evidence.
• For maintainer-owned PRs, prefer merging after CI green rather than self-approval theater; record the evidence in the merge plan.

Output

Lead with findings. If none:

Reviewed PR #N at `<sha>`.

No blocking findings.

Verification:
- <commands/checks>

Residual risk:
- <if any>