chore(agents): upgrade DWP to 2.17.0 + AI Diff Reviewer Flow B [skip release] by xergioalex · Pull Request #73 · DailybotHQ/cli

xergioalex · 2026-07-16T19:56:07Z

Important

Merge with [skip release] in the squash-commit body. The auto-release workflow greps the head commit on main — not this PR body — so the marker must land in the squash commit itself (AGENTS.md § 15.a). In the GitHub merge dialog, keep/add the literal line [skip release] in the commit body, or merge with:

gh pr merge 73 --squash --subject "chore(agents): upgrade DWP to 2.17.0 + AI Diff Reviewer Flow B (#73)" --body "[skip release]"

Rationale (maintainer-requested): this PR only touches vendored skill packs, agent docs, and CI wiring — nothing a CLI user installs — so cutting a PyPI/Homebrew release for it would ship an empty version bump. Note this extends the single documented [skip release] use case (dailybot skill-pack dogfood sync); applied here on explicit maintainer request.

Summary

Upgrade vendored Deep Work Plan skill pack from 2.16.0 → 2.17.0 (includes the new AI Diff Reviewer addon).
Install AI Diff Reviewer v2.0.0 in Flow B (local Security Review augmentation + CI).
Wire .github/workflows/pr-review.yml gated on the Ready label; extension at .review/extension.md; stable check AI review gate.
Update AGENTS.md, catalogs, and docs/PR_REVIEW_WORKFLOW.md. No runtime CLI code changes.

Test plan

Confirm .agents/skills/deepworkplan/SKILL.md reports version: "2.17.0"
Confirm .agents/skills/ai-diff-reviewer/ and skills-lock.json are present
Open a draft PR (or use this one), apply label Ready, verify pr-review workflow runs (needs repo secret CURSOR_API_KEY)
Confirm merge gate check name is AI review gate
Local: invoke "Review my current branch" with the vendored skill + .review/extension.md

[skip release]

Made with Cursor

Re-vendor Deep Work Plan at v2.17.0 (adds the ai-diff-reviewer addon), install the AI Diff Reviewer skill v2.0.0 with a CLI-specific .review/extension.md, and wire dual-surface review: local Security Review augmentation plus CI gated on the Ready label via pr-review.yml. Co-authored-by: Cursor <cursoragent@cursor.com>

…e caveats ## Summary Fixes the three warnings from the AI Diff Reviewer pass on PR #73. ## Change Log - Add the four missing .agents/commands/ thin delegators for the /ai-diff-reviewer-* slash commands documented in COMMANDS_REFERENCE.md (discoverability depends on these files existing, per the catalog's own conventions section) - pr-review.yml: comment on the trigger block spelling out that `synchronize` is deliberately omitted and a fix push requires removing + re-applying `Ready` to re-review - docs/PR_REVIEW_WORKFLOW.md: correct the "re-runs on every push" claims to the label-gated model, add "Re-running the review after a fix push" and "Fork and external-contributor PRs skip the gate" sections (skipped required check = passing) - AGENTS.md: anchor on  (claude-review- marker is legacy) and note the label-gated re-review model ## Risks - None — docs and workflow comments only; no behavioral change to the workflow triggers or the CLI Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

@v2

## Summary Round-2 AI review fixes: write-tier fork PRs used to fall through to the secret gate and fail with a misleading "CURSOR_API_KEY is not configured" (GitHub never exposes repo secrets to fork pull_request runs), and the floating @v2 action pin could drift from the vendored v2.0.0 skill, breaking the local<->CI prompt-parity claim. ## Change Log - scope job: detect fork heads (IS_FORK) after the Ready gate and skip with empty_reason=fork-no-secrets + an actionable notice (push the branch to origin and re-apply Ready) - gate job: treat fork-no-secrets like author-association (gate skipped, not failed); comment updated to list all three skip paths - Pin DailybotHQ/ai-diff-reviewer@v2.0.0 (matches the vendored skill); bump procedure documented inline (pin + vendored skill together) - Header: drop the phantom "matrix" wording (single review job) and document the fork-skip behavior - docs/PR_REVIEW_WORKFLOW.md: three-way outcome table (external -> skip/pass, write-tier same-repo -> review, write-tier fork -> skip with fork-no-secrets) ## Risks - Low — fork-head PRs now skip the gate instead of hard-failing; the documented trade-off (skipped required check = passing) is unchanged and covered in the same docs section Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

@v6

## Summary Round-3 AI review fixes. The blocking one: this PR plans a [skip release] merge but AGENTS.md § 15.a only sanctioned the dailybot skill-pack dogfood sync, so the policy and the maintainer's explicit request contradicted each other. § 15.a (and the auto-release.yml header that restates it) now define a second accepted use case: vendored agent-tooling syncs whose diff ships nothing to CLI users, applied only on explicit per-PR maintainer request. ## Change Log - AGENTS.md § 15.a: allowed scope is now two enumerated use cases (dailybot dogfood sync; maintainer-requested agent-tooling sync) - auto-release.yml header: same two-case policy text - pr-review.yml: actions/checkout@v4 -> @v6 (every other workflow in this repo pins v6) - .agents/commands/ai-diff-reviewer.md: delegator for the parent local-review flow + catalog row now lists the /ai-diff-reviewer alias - .review/extension.md: record the no-synchronize trigger and the skipped-gate-counts-as-passing behavior as accepted, documented design decisions so reviews stop re-flagging them every round ## Risks - None at runtime — policy docs, workflow comments, a checkout major bump aligned with the rest of the repo, and reviewer configuration Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

github-actions · 2026-07-16T21:59:36Z

AI review for `36e93b5` — ✅ done

View review →

Highest severity: warning

Strictness gate: ✅ highest severity warning ≤ critical threshold

1 inline comment(s) attached.

Iteration-Aware Review: gen 4, round 3, policy=first-pass-exhaustive (same_generation) — 1 surfaced.

github-actions

Verdict

Solid Flow B wiring after three review rounds — one warning: the [skip release] policy update is incomplete because the release doc still contradicts it.

Findings

#	Severity	File	Summary
1	⚠️ warning	`AGENTS.md:327`	Use case (b) added in AGENTS / auto-release, but `docs/RELEASE_AND_DISTRIBUTION.md` still says one use case and forbids workflow-only skips

Notes (no inline comment)

Vendored packs: DWP 2.17.0 + AI Diff Reviewer 2.0.0 with skills-lock.json; command delegators and catalogs look aligned. Did not nit upstream skill internals.
pr-review.yml: Ready-label gate, fork-no-secrets skip, pin @v2.0.0, persist-credentials: false, loud fail on missing CURSOR_API_KEY, and stable AI review gate are coherent. Deliberate no-synchronize and skipped-gate-as-pass are documented — not re-flagged.
Praise: Fork-head handling vs a misleading secret error, and recording accepted design decisions in .review/extension.md, are good hardening.

Release decision

Recommendation: request-changes

github-actions · 2026-07-16T22:01:04Z

+3. **Allowed scope: exactly two use cases.**
+   - **(a) Dailybot skill-pack dogfood sync** — a PR whose entire diff is the synchronisation of `.agents/skills/dailybot/` (plus the minimal catalog / `AGENTS.md` updates that reference it) to a newly published upstream `DailybotHQ/agent-skill` release. This is the loop-breaking case described above.
+   - **(b) Vendored agent-tooling sync (maintainer-requested)** — a PR whose entire diff lives in agent/CI tooling that ships nothing to CLI users: vendored skill packs under `.agents/` (DWP, AI Diff Reviewer, …), `.agents/commands/` delegators, `.review/`, `skills-lock.json`, the workflows that wire them, and the docs that reference them. Because no user-installable artifact changes, a release would be an empty version bump. This case additionally requires the **maintainer to explicitly request the marker on that PR** (rule 2 already forbids automatic application; for case (b) the request must be per-PR, not standing).


AGENTS.md Rule 15.a (and the matching auto-release.yml header) now define two [skip release] use cases, but docs/RELEASE_AND_DISTRIBUTION.md § "When (and only when) to use it" still says there is one accepted use case and lists "CI-only or workflow-only PRs" as forbidden.

Failure mode: a maintainer (or agent) reading only the release doc will treat use case (b) — and this PR's own merge — as a policy bug, or refuse a valid agent-tooling skip. auto-release.yml still points readers at that doc as "the full policy".

Please update docs/RELEASE_AND_DISTRIBUTION.md to match rule 3 (a)/(b), including the per-PR maintainer-request requirement for (b), so the three policy surfaces stay in sync.

* fix(ci): run label bootstrap unconditionally to break the Ready chicken-and-egg ## Summary Round-4 AI review fixes. On a clean installation the labels-bootstrap job was gated on should_run=true, which itself requires the Ready label to already be applied — so the job that creates the Ready label could never run before the label existed. ## Change Log - labels-bootstrap: drop the should_run condition; the job now runs on every opened/labeled event (idempotent, ~4s) - The second round-4 finding (vendored apply-review/open-pr SKILL.md declaring git+gh via requires.anyBins when both are mandatory) is an upstream defect in the skill pack — deferred to DailybotHQ/ai-diff-reviewer#42 rather than hand-editing the vendored tree and drifting it from the skills-lock.json content hash ## Risks - None — one job condition removed; the bootstrap step was already idempotent (`|| true` on existing labels) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs(release): align RELEASE_AND_DISTRIBUTION.md with the two-case [skip release] policy ## Summary Round-5 AI review fix: AGENTS.md § 15.a and the auto-release.yml header were expanded to two accepted [skip release] use cases, but docs/RELEASE_AND_DISTRIBUTION.md still said "one accepted use case" and listed CI/workflow-only PRs as forbidden — contradicting case (b) and this PR's own merge policy. ## Change Log - RELEASE_AND_DISTRIBUTION.md § "When (and only when) to use it": two enumerated cases matching AGENTS.md § 15.a; forbidden list narrowed to CLI docs and release/test-pipeline CI (agent-tooling wiring is case (b)) - AGENTS.md § 15.a opening line no longer says "one narrow situation" while rule 3 enumerates two ## Risks - None — policy documentation only Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>