feat(source-control): review instruction-surface diffs in pull-request ready #7351

Activity

1. github-actions

   added

   needs-triageNot yet classified. Floor until a type and one priority tier are set.Not yet classified. Floor until a type and one priority tier are set.

   on Oct 12, 2026
2. github-actions commented on Oct 12, 2026

   

   github-actionsBot

   on Oct 12, 2026 – with GitHub Actions

   Contributor

   More actions

   Understood: /source-control:pull-request ready (2.5.3 in ready-for-review.md) skips code and security review whenever a diff is docs-only by file type, but an instruction-surface diff (AGENTS.md, CLAUDE.md, .claude/rules/, skill/agent bodies) is docs-only by type while still changing what agents do. Proposal: treat such diffs as not docs-only for 2.5.3 so at least the security review runs before the flip. Confirmed the cited lines exist and the carve-out reads as described. No duplicates found. Nothing missing to start scoping this.

   _{Automated triage. A maintainer reviews it.}
3. github-actions

   added

   priority: mediumReal value, no hard deadline; normal backlog flow.Real value, no hard deadline; normal backlog flow.

   and removed

   needs-triageNot yet classified. Floor until a type and one priority tier are set.Not yet classified. Floor until a type and one priority tier are set.

   on Oct 12, 2026
4. github-actions

   added the

   Feature

   issue type on Oct 12, 2026
5. kyle-sexton commented on Oct 13, 2026

   

   kyle-sexton

   on Oct 13, 2026

   MemberAuthor

   More actions

   Decision recorded. The owner approved applying independently verified recommendations (confirmed, low-risk set) on 2026-10-13.

   • Which reviews should an instruction-surface diff get in 2.5.3? → Both code review and security review
     Basis: plugins/source-control/skills/pull-request/reference/merge.md:40 ("instruction surfaces steer future agent behavior"); ready-for-review.md:87 and :91 (both reviews keyed on "not docs-only"); docs: let the session that opened a PR flip it through pull-request ready #7346 body ("ready skips both reviews for a docs-only diff")
   • Where is the instruction-surface list defined? → Define it once in ready-for-review.md 2.5.3 and have prep.md's class table cite it
     Basis: plugins/source-control/skills/pull-request/reference/prep.md:21; ready-for-review.md:91

   /source-control:pull-request ready skips both code and security review for a docs-only diff, so a diff that only changes instruction surfaces (AGENTS.md, CLAUDE.md, .claude/rules/, skill and agent bodies) gets no local review before the flip. Still open on main; it matters once #7346 (open, held for a human merge) lets the session that opened a PR flip it.

   Verification notes:

   • prep.md:48 (added-suppressions check) also keys on 'any diff that is not docs-only'; a single 2.5.3 definition should state whether it covers that row too
   • Record calls docs: let the session that opened a PR flip it through pull-request ready #7346 'held for a human merge'; it is open, not draft, with no label (no hold label observed)

   Verified by an independent fresh-context check (confirmed, risk low): gh issue view 7351 (open, only bot triage comment, no owner decision); origin/main ready-for-review.md:87,:91; origin/main merge.md:40; origin/main prep.md:21,:29,:48; git grep docs-only in plugins/source-control; git log origin/main -- pull-request/reference

   Admission to an agent lane stays with the work-class rules and owner ratification.
6. kyle-sexton commented on Oct 18, 2026

   

   kyle-sexton

   on Oct 18, 2026

   MemberAuthor

   More actions

   Agent Brief

   Type: Feature
   Summary: /source-control:pull-request ready runs code and security review on a diff that changes an instruction surface, even when it is docs-only by file type.

   Current behavior:
   The ready flow skips both the code review and the security review for a docs-only diff. A diff that changes AGENTS.md, CLAUDE.md, .claude/rules/ or skill and agent bodies counts as docs-only, so it gets no local review before the flip, though it changes what agents do.

   Desired behavior:

   • The ready reference defines the instruction-surface list once (AGENTS.md, CLAUDE.md, .claude/rules/, skill and agent bodies) and treats a diff touching any of them as not docs-only, so both code and security review run.
   • The prep reference's class table cites that one definition instead of restating it.
   • The definition says whether it also applies to the added-suppressions check in prep.

   Key interfaces:

   • Ready-flow review conditions: 'not docs-only' now includes instruction-surface diffs.
   • Instruction-surface list: one definition, cited elsewhere.

   Acceptance criteria:

   • The ready reference holds the instruction-surface list once and both review rows key on it.
   • The prep class table cites that definition and does not restate the list.
   • The definition states its effect on the added-suppressions row.
   • scripts/check-changelog-fragments.sh passes.

   Out of scope:

   • The docs: let the session that opened a PR flip it through pull-request ready #7346 carve-out for flipping one's own PR.
   • CI review lanes.
   • Merge gating.

   ---

   This was generated by AI during backlog shaping. Held, not admitted: this brief is drafted and checked, but the issue lane would stop on it today. It is admitted, by adding agent-ready, once the lane can run the skill-quality check scripts (Automation Lanes' PR #7912). Held under the owner's 2026-10-18 lane-narrowing course correction.
7. kyle-sexton

   added

   needs-humanHuman-in-the-loop required; autonomous sessions must not resolve items carrying this.Human-in-the-loop required; autonomous sessions must not resolve items carrying this.

   agent-readyFully specified and briefed; eligible for autonomous pickup from the frontier.Fully specified and briefed; eligible for autonomous pickup from the frontier.

   work-class: scopedA briefed fix or small feature; blast radius bounded by the brief, tests exist.A briefed fix or small feature; blast radius bounded by the brief, tests exist.

   and removed

   needs-humanHuman-in-the-loop required; autonomous sessions must not resolve items carrying this.Human-in-the-loop required; autonomous sessions must not resolve items carrying this.

   on Oct 18, 2026
8. github-merge-queue

   added a commit that references this issue on Oct 19, 2026

   fix(source-control): review instruction-surface diffs in pull-request…

   ...

   This issue will close once commit d4c59e1 is merged into the 'main' branch.

   d4c59e1
9. melodic-automation-lanes

   closed this as completedin #8104on Oct 19, 2026