[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71SBJM789APQAXCCZVC7JG4":3,"skill-same:01M71SBJM789APQAXCCZVC7JG4":85},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":49,"linkOnly":50,"markdownContent":51,"markdownBody":52,"frontMatter":53,"refName":55,"commitSha":56,"skillDirectory":57,"forksCount":58,"repositoryHtmlUrl":59,"repositoryHomepageUrl":60,"ownerHtmlUrl":61,"ownerBlogUrl":62,"ownerDescription":63,"updatedAt":64,"install":65,"resources":78},"01M71SBJM789APQAXCCZVC7JG4","review-contract",null,"The canonical review findings contract — JSON schema, severity enum, mechanical severity→event mapping, confidence ≥0.8 rule","HigorAlves\u002Forc","HigorAlves","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F11262976?v=4","01M71S79EZEMHZ8PQSV0XQJHYY","Higor Alves","01M71S79FKKTCHCN1EDR8DSTWQ",7,"MIT","https:\u002F\u002Fgithub.com\u002FHigorAlves\u002Forc\u002Fblob\u002Fmain\u002Fcodex\u002Forc\u002Fcontent\u002Fskills\u002Freview-contract\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48],"review contract","contract","review","structured","rule","json","enum","use","schema","event","severity","posting","json schema","mapping","canonical","reviewer","when","new","mechanical","review findings","2026-11-10 13:02:02",false,"---\nname: review-contract\ndescription: The canonical review findings contract — JSON schema, severity enum, mechanical severity→event mapping, confidence ≥0.8 rule\nwhen_to_use: Use when producing, merging, or posting structured review findings, or when building a new reviewer agent.\n---\n\n# Review contract\n\nOne schema, one severity vocabulary, one event rule — defined here and only\nhere. Reviewer agents preload this skill; the posting layer (`orc-inline-review`)\nand any new reviewer agent reference it instead of restating it.\n\n## Finding schema\n\nReviewer agents return **strict JSON only** (no surrounding markdown, no prose\npreamble):\n\n```json\n{\n  \"summary\": \"≤ 2 sentences, ~40 words: one clause on what the PR does + finding counts by severity. Informational only — does NOT decide the event.\",\n  \"findings\": [\n    {\n      \"path\": \"src\u002Fauth.ts\",\n      \"line\": 42,\n      \"start_line\": null,\n      \"side\": \"RIGHT\",\n      \"severity\": \"bug\",\n      \"title\": \"Null deref when token absent\",\n      \"body\": \"When `req.headers.authorization` is missing, `parseToken()` returns null and the next line dereferences `.userId` unconditionally — 500 to client, no log. Guard with an early return.\",\n      \"suggestion_code\": \"const token = parseToken(req);\\nif (!token) return res.status(401).end();\",\n      \"confidence\": 0.92\n    }\n  ]\n}\n```\n\nZero findings: `{\"summary\": \"No actionable issues found. …\", \"findings\": []}` —\nthe posting layer computes APPROVE from the empty list.\n\n### Field semantics\n\n- **Required per finding:** `path`, `line`, `severity`, `title`, `body`, `confidence`.\n- **Optional:** `start_line` (multi-line spans: `start_line: 45, line: 47`; else `null`), `suggestion_code` (see gate below; else `null`).\n- **`path`** — repo-relative POSIX path. NOT a URL, NOT `a\u002F`- or `b\u002F`-prefixed. In workspace mode, still repo-relative; the orchestrator prefixes `[repo:\u003Cname>]`.\n- **`line`** — line number in the **NEW** file (post-change), computed from the diff hunk header `@@ -OLD,N +NEW,N @@` plus offset within the hunk. NOT the hunk offset.\n- **`side`** — always `\"RIGHT\"` (the new\u002Fchanged code).\n- **`title`** — ≤ 80 chars, one line.\n- **`body`** — `orc-caveman-review` tone: terse, actionable, signal-only.\n- **`confidence`** — 0–1. **Drop the finding entirely if \u003C 0.8.** A noisy review burns the author's time; false positives erode trust faster than misses.\n\n### `suggestion_code` gate\n\nSet only when ALL hold; otherwise `null` and describe in `body`:\n\n1. **Length** — ≤ 6 lines. Longer \"fixes\" are refactors disguised as fixes.\n2. **Completeness** — committing it FULLY resolves the issue.\n3. **Mental compile** — syntactically valid, references only symbols visible at that line, no imports the author must add separately.\n\n## Severity enum → event mapping (the iron rule)\n\n`severity` ∈ `\"bug\" | \"security\" | \"api-surface\" | \"test\" | \"nit\" | \"suggestion\" | \"question\"`.\n\nAgents do NOT decide the review event. The posting layer computes it\nmechanically from the **set** of severities; the agent's `summary` narrative is\nignored for the verdict:\n\n| Severity | Meaning | Effect |\n|----------|---------|--------|\n| `bug` | Real correctness problem landing on this PR | **Forces REQUEST_CHANGES** (one is enough) |\n| `security` | Auth bypass, injection, secret leak, unsafe deserialization, SSRF, … | **Forces REQUEST_CHANGES** |\n| `api-surface` | Wrongly exposed endpoint, breaking API change, dead public path | **Forces REQUEST_CHANGES** |\n| `test` | Real test gap on the changed surface | **Forces REQUEST_CHANGES**; `--soft-tests` relaxes to COMMENT |\n| `nit` | Style\u002Fnaming the linter doesn't catch | COMMENT only |\n| `suggestion` | Improvement opportunity, no correctness concern | COMMENT only |\n| `question` | Not sure it's a bug — asking the author | COMMENT only |\n\n```\ndef compute_event(findings, soft_tests=False):\n    severities = {f.severity for f in findings}\n    blocking = {\"bug\", \"security\", \"api-surface\"}\n    if not findings:\n        return \"APPROVE\"\n    if severities & blocking:\n        return \"REQUEST_CHANGES\"\n    if \"test\" in severities and not soft_tests:\n        return \"REQUEST_CHANGES\"\n    return \"COMMENT\"\n```\n\n### Self-contradiction detection (mandatory at the posting layer)\n\nIf the `summary` contains any of `[\"approve\", \"lgtm\", \"looks good\", \"no concerns\", \"non-blocking\"]`\nAND any finding has a blocking severity, warn the user\n(`> **⚠️ Caution**` callout), then post the **computed** event anyway. The\ncontradiction never ships.\n\n## Standards axis and the smell baseline\n\nDocumented standards (`CODING_STANDARDS.md`, `CONTRIBUTING.md`, `AGENTS.md`) are reviewed as severity `suggestion` with the rule cited. Beneath them sits a fixed Fowler smell baseline — [references\u002FSMELLS.md](references\u002FSMELLS.md) — that applies even when a repo documents nothing: always a judgement call, always `suggestion`, always overridden by a documented repo standard. Standards findings and spec-conformance findings are two axes: count them separately in `summary`, never rerank one against the other.\n\n## Universal reviewer rules\n\n- **Only the diff.** Never flag pre-existing issues the change didn't touch or surface.\n- **Confidence ≥ 0.8 or drop.** Applies to every finding, every reviewer.\n- **JSON-only output** from agents; the orchestrator parses it directly.\n- **Severity is by impact, not ease of fix.** A one-line-fix auth bypass is still `security`.\n\n## Consumers\n\n- `orc-pr-reviewer` \u002F `orc-security-reviewer` — preload this skill (`skills:` frontmatter) and emit the schema above.\n- `orc-inline-review` — converts findings to a posted GitHub review; owns the posting mechanics (backends, preview gate, ≤15-comment cap) and defers to this contract for schema + event rule.\n- New reviewer agents (e.g. CI or docs lenses) — preload this skill; add only their lens-specific taxonomy.\n","# Review contract\n\nOne schema, one severity vocabulary, one event rule — defined here and only\nhere. Reviewer agents preload this skill; the posting layer (`orc-inline-review`)\nand any new reviewer agent reference it instead of restating it.\n\n## Finding schema\n\nReviewer agents return **strict JSON only** (no surrounding markdown, no prose\npreamble):\n\n```json\n{\n  \"summary\": \"≤ 2 sentences, ~40 words: one clause on what the PR does + finding counts by severity. Informational only — does NOT decide the event.\",\n  \"findings\": [\n    {\n      \"path\": \"src\u002Fauth.ts\",\n      \"line\": 42,\n      \"start_line\": null,\n      \"side\": \"RIGHT\",\n      \"severity\": \"bug\",\n      \"title\": \"Null deref when token absent\",\n      \"body\": \"When `req.headers.authorization` is missing, `parseToken()` returns null and the next line dereferences `.userId` unconditionally — 500 to client, no log. Guard with an early return.\",\n      \"suggestion_code\": \"const token = parseToken(req);\\nif (!token) return res.status(401).end();\",\n      \"confidence\": 0.92\n    }\n  ]\n}\n```\n\nZero findings: `{\"summary\": \"No actionable issues found. …\", \"findings\": []}` —\nthe posting layer computes APPROVE from the empty list.\n\n### Field semantics\n\n- **Required per finding:** `path`, `line`, `severity`, `title`, `body`, `confidence`.\n- **Optional:** `start_line` (multi-line spans: `start_line: 45, line: 47`; else `null`), `suggestion_code` (see gate below; else `null`).\n- **`path`** — repo-relative POSIX path. NOT a URL, NOT `a\u002F`- or `b\u002F`-prefixed. In workspace mode, still repo-relative; the orchestrator prefixes `[repo:\u003Cname>]`.\n- **`line`** — line number in the **NEW** file (post-change), computed from the diff hunk header `@@ -OLD,N +NEW,N @@` plus offset within the hunk. NOT the hunk offset.\n- **`side`** — always `\"RIGHT\"` (the new\u002Fchanged code).\n- **`title`** — ≤ 80 chars, one line.\n- **`body`** — `orc-caveman-review` tone: terse, actionable, signal-only.\n- **`confidence`** — 0–1. **Drop the finding entirely if \u003C 0.8.** A noisy review burns the author's time; false positives erode trust faster than misses.\n\n### `suggestion_code` gate\n\nSet only when ALL hold; otherwise `null` and describe in `body`:\n\n1. **Length** — ≤ 6 lines. Longer \"fixes\" are refactors disguised as fixes.\n2. **Completeness** — committing it FULLY resolves the issue.\n3. **Mental compile** — syntactically valid, references only symbols visible at that line, no imports the author must add separately.\n\n## Severity enum → event mapping (the iron rule)\n\n`severity` ∈ `\"bug\" | \"security\" | \"api-surface\" | \"test\" | \"nit\" | \"suggestion\" | \"question\"`.\n\nAgents do NOT decide the review event. The posting layer computes it\nmechanically from the **set** of severities; the agent's `summary` narrative is\nignored for the verdict:\n\n| Severity | Meaning | Effect |\n|----------|---------|--------|\n| `bug` | Real correctness problem landing on this PR | **Forces REQUEST_CHANGES** (one is enough) |\n| `security` | Auth bypass, injection, secret leak, unsafe deserialization, SSRF, … | **Forces REQUEST_CHANGES** |\n| `api-surface` | Wrongly exposed endpoint, breaking API change, dead public path | **Forces REQUEST_CHANGES** |\n| `test` | Real test gap on the changed surface | **Forces REQUEST_CHANGES**; `--soft-tests` relaxes to COMMENT |\n| `nit` | Style\u002Fnaming the linter doesn't catch | COMMENT only |\n| `suggestion` | Improvement opportunity, no correctness concern | COMMENT only |\n| `question` | Not sure it's a bug — asking the author | COMMENT only |\n\n```\ndef compute_event(findings, soft_tests=False):\n    severities = {f.severity for f in findings}\n    blocking = {\"bug\", \"security\", \"api-surface\"}\n    if not findings:\n        return \"APPROVE\"\n    if severities & blocking:\n        return \"REQUEST_CHANGES\"\n    if \"test\" in severities and not soft_tests:\n        return \"REQUEST_CHANGES\"\n    return \"COMMENT\"\n```\n\n### Self-contradiction detection (mandatory at the posting layer)\n\nIf the `summary` contains any of `[\"approve\", \"lgtm\", \"looks good\", \"no concerns\", \"non-blocking\"]`\nAND any finding has a blocking severity, warn the user\n(`> **⚠️ Caution**` callout), then post the **computed** event anyway. The\ncontradiction never ships.\n\n## Standards axis and the smell baseline\n\nDocumented standards (`CODING_STANDARDS.md`, `CONTRIBUTING.md`, `AGENTS.md`) are reviewed as severity `suggestion` with the rule cited. Beneath them sits a fixed Fowler smell baseline — [references\u002FSMELLS.md](references\u002FSMELLS.md) — that applies even when a repo documents nothing: always a judgement call, always `suggestion`, always overridden by a documented repo standard. Standards findings and spec-conformance findings are two axes: count them separately in `summary`, never rerank one against the other.\n\n## Universal reviewer rules\n\n- **Only the diff.** Never flag pre-existing issues the change didn't touch or surface.\n- **Confidence ≥ 0.8 or drop.** Applies to every finding, every reviewer.\n- **JSON-only output** from agents; the orchestrator parses it directly.\n- **Severity is by impact, not ease of fix.** A one-line-fix auth bypass is still `security`.\n\n## Consumers\n\n- `orc-pr-reviewer` \u002F `orc-security-reviewer` — preload this skill (`skills:` frontmatter) and emit the schema above.\n- `orc-inline-review` — converts findings to a posted GitHub review; owns the posting mechanics (backends, preview gate, ≤15-comment cap) and defers to this contract for schema + event rule.\n- New reviewer agents (e.g. CI or docs lenses) — preload this skill; add only their lens-specific taxonomy.\n",{"name":5,"description":7,"when_to_use":54},"Use when producing, merging, or posting structured review findings, or when building a new reviewer agent.","main","7522fd7266944e30052204c2f6df287d8b5516be","codex\u002Forc\u002Fcontent\u002Fskills\u002Freview-contract",0,"https:\u002F\u002Fgithub.com\u002FHigorAlves\u002Forc","https:\u002F\u002Forc.novacstack.com\u002F","https:\u002F\u002Fgithub.com\u002FHigorAlves","higoralves.dev","Software Engineering","2026-11-07 07:26:38",{"source":8,"skillName":5,"commands":66,"prompt":76,"zipAvailable":77},[67,70,73],{"tool":68,"command":69},"npx","npx skills add HigorAlves\u002Forc --skill review-contract",{"tool":71,"command":72},"bunx","bunx skills add HigorAlves\u002Forc --skill review-contract",{"tool":74,"command":75},"pnpm","pnpm dlx skills add HigorAlves\u002Forc --skill review-contract","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FHigorAlves\u002Forc\u002Fblob\u002Fmain\u002Fcodex\u002Forc\u002Fcontent\u002Fskills\u002Freview-contract\u002FSKILL.md",true,[79],{"path":80,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":83,"sourceHtmlUrl":84},"references\u002FSMELLS.md","REFERENCE","参考文档",3081,"https:\u002F\u002Fgithub.com\u002FHigorAlves\u002Forc\u002Fblob\u002Fmain\u002Fcodex\u002Forc\u002Fcontent\u002Fskills\u002Freview-contract\u002Freferences\u002FSMELLS.md",[86,120,144,165,187,207],{"skillNo":87,"name":88,"nameZh":6,"description":89,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":90,"categories":91,"keywords":101,"publishedAt":49},"01M71SW40F9TAAEDKBYYBCM814","writing-plans","Write a comprehensive implementation plan of bite-sized TDD tasks that an engineer with zero codebase context could execute — exact files, code, tests, and verification steps","https:\u002F\u002Fgithub.com\u002FHigorAlves\u002Forc\u002Fblob\u002Fmain\u002Forc\u002Fskills\u002Fwriting-plans\u002FSKILL.md",[92,95,98],{"categoryNo":93,"categoryName":94,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":96,"categoryName":97,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000030","开发工程师",{"categoryNo":99,"categoryName":100,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000036","内容创作者",[102,103,104,105,106,107,108,45,109,110,111,112,113,114,115,116,117,118,119,36],"writing","writing plans","plans","engineer","superpowers","implementation plan","files","you","code","tasks","verification","plan","write","steps","context","ZeRO","for","tests",{"skillNo":121,"name":122,"nameZh":6,"description":123,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":124,"categories":125,"keywords":129,"publishedAt":49},"01M71SW15KHE4MHJW9NEXV65X2","writing-for-agents","orc's doctrine layer for writing any document an agent consumes — skills, AGENTS.md\u002FCLAUDE.md, reference docs","https:\u002F\u002Fgithub.com\u002FHigorAlves\u002Forc\u002Fblob\u002Fmain\u002Forc\u002Fskills\u002Fwriting-for-agents\u002FSKILL.md",[126,127,128],{"categoryNo":93,"categoryName":94,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":99,"categoryName":100,"taxonomyType":26,"taxonomyTypeDesc":27},[130,102,118,131,45,132,133,134,135,136,137,138,36,139,140,141,142,143],"writing for agents","matt pocock","inline","tuning","a skill","layer","doctrine","push","editing","document","github","https","reference","docs",{"skillNo":145,"name":146,"nameZh":6,"description":147,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":148,"categories":149,"keywords":151,"publishedAt":49},"01M71SVYQKXT743HHHWGHT3G13","workspace-mode","Use when cwd is a parent dir holding multiple sibling git repos — defines repo auto-detection, --repos\u002F--repo\u002F--all-repos\u002F--this-repo precedence, per-repo dispatch, and linked-PR mechanics.","https:\u002F\u002Fgithub.com\u002FHigorAlves\u002Forc\u002Fblob\u002Fmain\u002Forc\u002Fskills\u002Fworkspace-mode\u002FSKILL.md",[150],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[152,153,154,155,156,45,157,158,159,160,36,161,162,163,164],"workspace mode","mode","workspace","mechanics","auto","repos","git","pr","repo","dispatch","auto-detection","detection","parent",{"skillNo":166,"name":167,"nameZh":6,"description":168,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":169,"categories":170,"keywords":172,"publishedAt":49},"01M71SVVP3BXS06G9395P2K0RH","wizard","Generate an interactive bash wizard walking a human through work only they can perform — credentials, secrets, one-off migrations","https:\u002F\u002Fgithub.com\u002FHigorAlves\u002Forc\u002Fblob\u002Fmain\u002Forc\u002Fskills\u002Fwizard\u002FSKILL.md",[171],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[167,173,174,175,176,131,45,177,178,179,180,181,182,115,183,184,118,36,185,186],"condition","never","provisioning infrastructure","only","Bash","work","credentials","generate","human","secrets","infrastructure","do","one","interactive",{"skillNo":188,"name":189,"nameZh":6,"description":190,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":191,"categories":192,"keywords":193,"publishedAt":49},"01M71SVT4AR6NKAM5B077E7QSJ","wait-what","Stop and re-pitch — the last message did not land; say it again simply, in the project's own vocabulary.","https:\u002F\u002Fgithub.com\u002FHigorAlves\u002Forc\u002Fblob\u002Fmain\u002Forc\u002Fskills\u002Fwait-what\u002FSKILL.md",[],[194,195,196,197,198,131,199,200,201,202,140,141,203,204,205,206],"wait what","wait","project","re","true","pitch","last","say","message","land","it","stop","vocabulary",{"skillNo":208,"name":209,"nameZh":6,"description":210,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":211,"categories":212,"keywords":217,"publishedAt":49},"01M71SVQVYRA9QBQ6G8MWR8G6F","vitest","Vitest fast unit testing framework powered by Vite with Jest-compatible API","https:\u002F\u002Fgithub.com\u002FHigorAlves\u002Forc\u002Fblob\u002Fmain\u002Forc\u002Fskills\u002Fvitest\u002FSKILL.md",[213,216],{"categoryNo":214,"categoryName":215,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":96,"categoryName":97,"taxonomyType":26,"taxonomyTypeDesc":27},[209,218,219,220,221,222,102,45,223,224,225,226,227,228,229,230,231,232,119,233],"coverage","unit","testing","testing framework","generated","api","jest","2026","at","scripts","unit testing","antfu","framework","vite","mocking","dev"]