feat(review): pilot MCP-aware skill and read-only health audits - #915
Conversation
Deploying zsh with
|
| Latest commit: |
580c432
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://182fe7e9.zsh.pages.dev |
| Branch Preview URL: | https://feature-914-review-skill-pil.zsh.pages.dev |
There was a problem hiding this comment.
🟡 Changes recommended
The required health-readiness procedure link is not currently resolvable.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Adds a pinned canonical code-review skill and makes health audits read-only unless remediation is explicitly authorized.
Changes:
- Adds provenance-preserving review guidance.
- Updates health-audit workflow and references.
- Nit: resolves the currently unavailable health-readiness procedure link.
File summaries
| File | Summary |
|---|---|
.github/skills/codebase-health-audit/SKILL.md |
Enforces read-only health reviews and scoped remediation. |
.github/skills/code-review/SKILL.md |
Adds the pinned canonical review skill. |
Review details
- Files reviewed: 2/2 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| which checks actually ran and their outcomes. | ||
|
|
||
| During a health evaluation, also follow the | ||
| [review-readiness procedure](https://github.com/z-shell/.github/blob/main/runbooks/org-review.md#repository-health-review-readiness). |
There was a problem hiding this comment.
Fixed in 1f3260c by pinning the installed skill metadata to the published canonical commit and updating the review-readiness link to that immutable runbook revision.
Agent handoffStatus: Blocked on canonical publication Current stateThe pinned skill is published on this PR branch. The health-procedure link correctly points to the canonical runbook, but its new anchor is not yet on main. The owning issue is now natively blocked by z-shell/.github#607 and marked Blocked in Project 28. Merge canonical PR z-shell/.github#608 before this pilot. Verification
Next steps
|
Co-authored-by: ss-o <59910950+ss-o@users.noreply.github.com>
Use the published MCP-aware source without local body customization. The canonical main-branch health procedure is now available.
ss-o
changed the title
There was a problem hiding this comment.
🔵 Needs a closer look
Explicit remediation authorization and the unavailable canonical guidance link must be addressed.
Review details
Suppressed comments (2)
.github/skills/code-review/SKILL.md:42
- This new link targets the default branch, but the current
z-shell/.githubmainversion ofmcp-plugins.instructions.mdhas noCopilot hosted reviewheading; that anchor exists only in the pinned0258173…source / #611 branch. Until #611 is published, this link is broken and reviewers cannot reach the hosted-compatibility guidance. Please publish that canonical change first, or update the canonical source to an immutable reference and reinstall while preserving provenance.
[integration guidance](https://github.com/z-shell/.github/blob/main/.github/instructions/mcp-plugins.instructions.md#copilot-hosted-review)
.github/skills/codebase-health-audit/SKILL.md:105
- These linked prompts still instruct the agent to apply fixes without requiring explicit, scoped remediation authorization (
.github/prompts/audit-consistency.prompt.md:7and.github/prompts/review-pr.prompt.md:9). The new boundary only governs an already-running health-audit skill; invoking either linked prompt directly still authorizes automatic edits, so the read-only audit contract is incomplete. Update those prompts to make read-only the default, or stop linking them here.
- Prompt: [audit-consistency](../../prompts/audit-consistency.prompt.md): single-task version
- Prompt: [review-pr](../../prompts/review-pr.prompt.md): scoped to changed files
- Files reviewed: 2/2 changed files
- Comments generated: 0 new
- Review effort level: Lite
Agent handoffStatus: Blocked Current state
Verification
Blockers
Next steps
|
There was a problem hiding this comment.
🔵 Needs a closer look
Required canonical links currently depend on unpublished changes and need human review before merging.
Review details
Suppressed comments (2)
.github/skills/code-review/SKILL.md:42
- This URL targets
z-shell/.githubmain, but that branch currently has noCopilot hosted reviewheading inmcp-plugins.instructions.md; the heading is introduced by the still-open #611 commit pinned by this installation. Until that canonical change is published, this required integration-guidance link is broken and the skill cannot reach its hosted-compatibility rules. Publish #611 before merging this pilot, or coordinate an immutable-source correction that preserves the provenance claim.
[integration guidance](https://github.com/z-shell/.github/blob/main/.github/instructions/mcp-plugins.instructions.md#copilot-hosted-review)
.github/skills/code-review/SKILL.md:92
- This link also targets the current
mainbranch, whoserunbooks/org-review.mdhas norepository-health-review-readinessheading; that anchor exists only in the pinned #611 source while the canonical PR remains open. Consequently the skill's required health-readiness procedure is still unreachable from this installation. Publish the canonical runbook change before merging, or use an immutable-source correction while preserving provenance.
[review-readiness procedure](https://github.com/z-shell/.github/blob/main/runbooks/org-review.md#repository-health-review-readiness).
- Files reviewed: 2/2 changed files
- Comments generated: 0 new
- Review effort level: Lite
Co-authored-by: ss-o <59910950+ss-o@users.noreply.github.com>
Refs #914. The canonical main-branch anchors are now published. Preserve prior commits while restoring native installation provenance.
|
Canonical #611 is merged as This pilot now uses a native installation pinned to that merged commit. Repeat native installation followed by repository formatting matches the delivered file byte-for-byte. Prior bot-authored commits and legitimate human coauthor credit are preserved. Earlier missing-anchor findings describe superseded repository state; changing the installed body would reintroduce provenance drift. Hosted MCP use remains unverified separately from this source delivery. |
There was a problem hiding this comment.
🔵 Needs a closer look
A remaining health-review prompt can still apply fixes without explicit, scoped authorization.
Review details
Suppressed comments (1)
Previously missed (1) — in code that hasn't changed since the last review.
.github/skills/codebase-health-audit/SKILL.md:23
- [P1] The read-only contract is not enforced for the repository's other health-review entry point:
.github/prompts/project-health.prompt.mdstill says “Audit and auto-fix” and “apply fixes directly,” so invoking that prompt can mutate the working tree without an explicit, scoped remediation request. Update that prompt (and any remaining health-review prompts) to report findings by default and gate edits on explicit authorization; removing links from this skill does not remove the executable mutation path.
- Files reviewed: 2/2 changed files
- Comments generated: 0 new
- Review effort level: Lite
Agent handoffStatus: Complete for skill delivery Current state and verificationCanonical #611 merged first. This pilot installs source Remaining runtime evidenceHosted MCP settings and actual discovery/invocation remain unverified. Skill installation does not establish runtime attribution. Activation and any wider repository rollout are separate follow-up scope recorded in z-shell/.github#606. |
Adds a native, provenance-preserving installation of the canonical code-review skill and makes repository-health audits read-only unless remediation is explicitly authorized.
The updated skill selects linked requirements, relevant CI evidence, canonical contracts, and version-matched documentation only when useful. MCP configuration, discovery, and invocation remain distinct; optional providers are not mandatory health gates.
The installed source is pinned to
e1f8f6c1c9dd61e87f2e5f44ef6285992b8b892dfrom z-shell/.github#611. Native installation followed by repository formatting preserves the canonical body. Copilot's previous immutable-link workaround is superseded by this native refresh: the required health-procedure anchor now exists on the canonical main branch.Closes #914. Refs z-shell/.github#606 and z-shell/.github#610. Canonical MCP guidance merged in z-shell/.github#611; both referenced main-branch anchors are verified. Hosted MCP settings and observed calls remain pending, and a Cloudflare documentation-server initialization attempt returned HTTP 403.
Validation: native source comparison, provenance checks, skill validation, repository formatting, and diff whitespace checks. Hosted checks are recorded on this PR's current head. No settings, credentials, or operational Cloudflare access are changed by this PR.