* chore: add reviewer-feedback guardrails (CLAUDE.md, pre-commit hook, skill)
Analysis of ~50 PRs from the past week identified 10 recurring themes
in Copilot and Gemini code review comments. This change addresses them
at development time through three layers:
1. CLAUDE.md additions (7 new rules):
- Transaction safety for multi-step DB operations
- UTF-8 string safety (no byte-index slicing)
- Case-insensitive comparisons for paths/media types
- Decorator/wrapper trait method delegation
- Sensitive data redaction in logs/SSE
- tempfile crate for test temporary files
- Trust boundaries for worker container data
2. Pre-commit hook (scripts/pre-commit-safety.sh):
Mechanical checks for unsafe byte slicing, case-sensitive
extension comparisons, hardcoded /tmp paths, unredacted
tool parameter logging, and non-transactional DB operations.
Installed via dev-setup.sh alongside existing commit-msg hook.
3. Review checklist skill (skills/review-checklist/SKILL.md):
Activates on "review"/"merge" keywords. Covers the judgment-based
items that can't be linted: transaction safety, SSRF validation,
approval checks, decorator delegation, test quality, and doc accuracy.
[skip-regression-check]
Co-Authored-By: Claude Opus 4.6 <[email protected]>
* fix: address PR review feedback on pre-commit-safety.sh
- Cache diff output in variable to avoid ~10 redundant git diff calls (Gemini)
- Add early exit when no .rs files are changed (Gemini)
- Fix header comment: list all 5 checks, not just 4 (Copilot)
- Fix check 2 comment: only mentions file extensions, not media types (Copilot)
- Add resolve_base_ref() with fallback candidates instead of hardcoded
origin/main for standalone mode (Copilot)
- TX check: use -W (function context) to reduce false positives, honor
// safety: suppression, print triggering lines (Copilot)
[skip-regression-check]
Co-Authored-By: Claude Opus 4.6 <[email protected]>
---------
Co-authored-by: Claude Opus 4.6 <[email protected]>
