feat(dwp): add ai-diff-reviewer addon + vendor dailybot + Cursor-based pr-review workflow#33
Merged
Merged
Conversation
…stream v1.7.0) Author the fifth DWP addon that connects an AI-first repo to the AI Diff Reviewer (DailybotHQ/ai-diff-reviewer, marketplace "AI Diff Reviewer", v1.7.0 upstream). Mirrors the dailybot addon shape: opt-in, never required, never blocks, reconcile-don't-clobber, vendor-neutral. Defers install, review methodology, workflow wizard, PR-body drafting, and post-CI walkthrough to the upstream skill's five coordinated sub-skills (parent default flow + generate-extension + setup + open-pr + apply-review). Ships the four mandatory addon components: - SKILL.md — the onboarding hook (Step 0 asks Flow A vs Flow B — never guesses, matching upstream v1.7.0's own ambiguity tie-break policy; Step 1 offers the vendored skill install with both `--yes` and `-y` flags; Step 2 defers CI-workflow authoring to the upstream `setup` wizard; Step 3 wires the mandatory DWP Security Review task to run the upstream parent default flow as an additive local review pass and, in Flow B, surfaces `apply-review` as an optional developer-invoked companion during `execute`). - SPEC.md — RFC-2119, 10 sections, formally defines both flows (§3), what the addon installs (§4), deferred auth + wizard handoff (§5), Security Review augmentation + optional apply-review companion (§6), never-block rule (§7), reconcile-don't-clobber with the 3-path extension-file precedence order (§8), 8-item conformance validation checklist (§9), archetype compatibility notes (§10). - templates/INTEGRATION.md — reasoning guidance for detecting existing setup, asking the flow question, installing the vendored skill, bootstrapping the extension via `generate-extension`, wiring the CI workflow via `setup` (with a minimal fallback shape when the developer skips the wizard), and never-block rules. - addons/README.md — new row + trailing-paragraph mention. The core DWP methodology has ZERO dependency on the AI Diff Reviewer; a repo with zero addons remains fully baseline-conformant. Task 2 wires this addon's Security Review augmentation into DWP `create`/`execute`. Co-authored-by: Cursor <cursoragent@cursor.com>
…hen addon installed
Wire the ai-diff-reviewer addon (authored in the previous commit) into the DWP
methodology's `create`, `execute`, and `guide` sub-skills. When a target repo
installs the addon, the mandatory Security Review task template gains an
additive local-review pass — verdict + findings table + severity — appended
under a dedicated heading in `analysis_results/SECURITY_REVIEW.md`. The
augmentation is conditional on `.agents/skills/ai-diff-reviewer/` being
present + an extension file at one of the three recognized paths (in
precedence order): `.review/extension.md`, `.github/ai-diff-reviewer/extension.md`,
or the back-compat `.github/ai-pr-reviewer/extension.md`. On repos without
the addon, the SR template body is unchanged (baseline conformance preserved).
Changes:
- `create/SKILL.md` "Three mandatory final tasks": adds an addon-augmentation
callout under the Security Review bullet. Names all three extension-file
paths, cites the upstream skill's five-sub-skill router (parent default
flow, `generate-extension`, `setup`, `open-pr`, `apply-review`), points at
the byte-identical `prompt.md` parity guarantee between skill and CI
Action, and describes the `apply-review` sub-skill as an OPTIONAL Flow B
companion during `execute` — never a plan task file. The mandatory-final-
task ORDER stays untouched (Security Review → Skills & Agents Discovery
→ Executive Report).
- `guide/GUIDE.md` §5.4: adds a subsection "AI Diff Reviewer local pass
(optional — addon-augmented)" describing detection, invocation, output
shape, integration into SECURITY_REVIEW.md, severity handling, and the
Flow B apply-review companion.
- `execute/SKILL.md` Step 5: adds a short callout about addon augmentation
of mandatory final tasks — currently only ai-diff-reviewer augments
Security Review; the note is generalized so future addons can plug in
without further edits to execute.
Every mention is conditional ("when installed", "opt-in", "optional"),
matching the addon SPEC's never-block rule. No new plan-task file for
`apply-review` (would violate the mandatory-final-task-order rule).
Co-authored-by: Cursor <cursoragent@cursor.com>
…endored Vendor both upstream skills into .agents/skills/ so the deepworkplan-skill repo can dogfood the two DWP addons it maintains: - .agents/skills/dailybot/ (from DailybotHQ/agent-skill@v3.10.3) - .agents/skills/ai-diff-reviewer/ (from DailybotHQ/ai-diff-reviewer@v1.7.0) Both installs used npx --yes skills add ... --force -y (both flags required — npx's --yes for npm's proceed prompt, and the CLI's -y for its own agent-picker prompt; missing either hangs in CI). skills-lock.json now carries three pinned entries: deepworkplan, dailybot, ai-diff-reviewer. Downstream tasks (4, 5, 6, 11) will now write the extension file, add the pr-review.yml workflow, extend auto-release.yml to update these vendored skills alongside deepworkplan, and document the new .agents/ layout. Co-authored-by: Cursor <cursoragent@cursor.com>
Adds the layered override that the vendored ai-diff-reviewer skill (Flow A today, Flow B once pr-review.yml lands in task 5) reads on top of its shipped default prompt. One file, two surfaces (local skill + CI Action), zero drift once both are wired. The file is 233 lines with four sections: - Severity overrides — code-anchored, cite AGENTS.md rule numbers, real paths (skills/deepworkplan/**, .agents/skills/**, .github/workflows/**, scripts/validate-frontmatter.py, auto-release.yml). `critical` bar: runtime boundary violations (files outside skills/deepworkplan/** read at runtime), hand-edits of `version:`/CHANGELOG.md/dogfood copy, sub-skill version drift from the router, public-surface breaks without a `feat!:` prefix, vendor coupling in the core methodology, weakening any of the four addon rules, .claude/*.cursor/* as canonical path in a new file, MIT-license removal, and `npx skills add` without both `--yes` and `-y`. `warning`: bash 4+ features in scripts, copy-paste in addon templates, non-uppercase RFC-2119 keywords, new Spanish content, workflow interpolation of pull_request.* into shell. `info` de-escalations: spec section-number churn, prose vs normative phrasing between guide/*.md and spec/*.md. - Don't comment on — assets/, spec line length, missing per-SKILL.md unit tests, .agents/skills/**/ hand-edits (vendored, auto-refreshed), .claude/**/CLAUDE.md content (symlinks), absence of a runtime manifest (this is a bash+python-stdlib skill by design). - Repo-specific conventions — runtime boundary, frontmatter fields, versioning ownership, addon contract, canonical vs symlinked paths, three-way dogfood (deepworkplan + dailybot + ai-diff-reviewer), branding rules, commit format. - PR hygiene — Conventional Commits, version-invariant check across the 8 in-tree SKILL.md files, new-addon four-component check, auto-release.yml `skills add` flag preservation, vendored-skill hand-edit sniff. Layers cleanly on top of the base prompt: never restates SQL-injection / input-validation / obvious-perf-regression rules; every rule cites a specific file, path, or AGENTS.md rule number. Co-authored-by: Cursor <cursoragent@cursor.com>
Adds .github/workflows/pr-review.yml — the CI-side AI review powered by
DailybotHQ/ai-diff-reviewer@v1 (marketplace: 'AI Diff Reviewer'), reading
the same .review/extension.md that Task 4 authored for the vendored local
skill. Because the upstream skill's prompt.md is byte-identical to the
Action's shipped prompts/default.md at the same tag (enforced by upstream
CI's 'Skills — prompt-sync invariant' job), local ≡ CI once both surfaces
reference this extension file.
Design (four coordinated jobs):
- scope — three-tier gate: (a) author-association ∈ {OWNER, MEMBER,
COLLABORATOR} — cheapest gate, cannot be spoofed (payload); (b) ready
label present (case-insensitive) — 'labeled' event triggers only when
the label just added is ready; 'opened' event triggers when ready is
already applied; (c) CURSOR_API_KEY configured. Emits should_run +
empty_reason for downstream jobs.
- labels-bootstrap — idempotent 'gh label create' for ready and
pr-reviewed; runs only when should_run=true.
- review — checks out with fetch-depth: 0 (base ref needed for the
branch diff) and persist-credentials: false (Cursor CLI has broad
local access; a persisted token on disk is an exfil surface).
Invokes DailybotHQ/ai-diff-reviewer@v1 with provider: cursor,
model: auto, label-gate: ready, strictness: block-on-critical,
applied-label: pr-reviewed, prompt-extension-file: .review/extension.md,
max-inline-comments: 15.
- gate — stable-named 'AI review gate' (this is the ONLY job to mark
required in branch protection). SKIPS on no-ready-label or
author-association empty_reason (skipped required checks pass in
GitHub); FAILS loud on no-provider-secret or review-leg failure.
Trigger discipline:
- pull_request only, types [opened, labeled], NOT synchronize —
push does not re-review; toggle the ready label to re-run.
- concurrency group keyed on PR number with cancel-in-progress.
Post-CI walkthrough (documented in the workflow header comment): after
this workflow posts its review, developers MAY invoke the skill's
apply-review sub-skill locally to walk through findings per-finding
(apply / defer / skip). Read-only by default; edits require per-finding
consent; never commits or pushes.
Co-authored-by: Cursor <cursoragent@cursor.com>
…ry release Extends .github/workflows/auto-release.yml with two structurally-identical dogfood steps inserted AFTER the existing 'Dogfood — refresh vendored deepworkplan' step and BEFORE 'Generate provenance checksums': - Dogfood — refresh vendored dailybot to latest upstream Resolves 'gh release view --repo DailybotHQ/agent-skill --json tagName' and re-vendors '.agents/skills/dailybot/' from that tag on every release we cut. No 'sleep 5' — the upstream tag is already propagated (this isn't the just-pushed tag we're waiting on). - Dogfood — refresh vendored ai-diff-reviewer to latest upstream Resolves 'gh release view --repo DailybotHQ/ai-diff-reviewer' and re- vendors '.agents/skills/ai-diff-reviewer/' from that tag. This is the local skill that reads '.review/extension.md' — keeping it current guarantees local ≡ CI once the pr-review.yml workflow (added in the previous commit) is also using the '@v1' moving tag from the same upstream. Both new steps: - Guarded by 'if: steps.version.outputs.skip != "true"' so no work runs on a no-release commit (matches the existing deepworkplan dogfood). - Fail hard on upstream tag lookup failure (a downstream release without a resolvable upstream is a broken release). - Fail hard on the version invariant (vendored SKILL.md 'version:' MUST equal the resolved upstream tag without the 'v' prefix). - Idempotent — 'git diff --quiet' before commit, so a no-change refresh emits an exit-0 notice and does not push a stale-content commit. - Commit with '[skip release]' marker so the auto-release job's own 'if:' guard filters the commit out of the next trigger. - Auth via 'AUTOMATION_GITHUB_TOKEN || GITHUB_TOKEN' — same convention as the existing steps. Critical (upstream-bug-fix regression guard): every 'npx skills add' in this workflow carries BOTH '--yes' (npm's proceed prompt) AND '-y' (the skills CLI's agent-picker prompt). Missing either hangs in a non-TTY runner — the exact failure mode that shipped upstream ai-diff-reviewer v1.6.x's auto-release into a stuck state and got fixed in v1.7.0. YAML validated via pyyaml. Co-authored-by: Cursor <cursoragent@cursor.com>
…SOR_API_KEY setup Extend AGENTS.md and add .github/docs/WORKFLOWS.md so every AI agent that reads this repo's contributor guide learns about: 1. Vendored agent skills — three dogfood copies now live under .agents/skills/ (deepworkplan / dailybot / ai-diff-reviewer). Document the per-skill upstream, the auto-release-driven refresh, the mandatory --yes + -y non-interactive contract, the version-invariant, and the "do not hand-edit" rule. 2. PR review workflow — Cursor-based, ready-label gated. Document the trigger, jobs, branch-protection integration, CURSOR_API_KEY setup, and the Local <-> CI <-> apply-review three-moment loop. 3. ai-diff-reviewer addon (opt-in, DWP-adjacent) — the counterpart to the vendored skill. Document the two adoption flows (A local-only, B dual-surface), the five sub-skills the addon defers to, and how it augments the mandatory Security Review task without altering plan task order. Also add .github/docs/WORKFLOWS.md as a per-workflow reference covering auto-release.yml, ci.yml, and pr-review.yml (Trigger / Jobs / Gate / Failure modes / interactions / External Actions / Secrets), aligned with the pattern the website repo uses. Update the Detailed Documentation table and Project Structure sections to point at the new files. No .claude/ or .cursor/ paths introduced. Co-authored-by: Cursor <cursoragent@cursor.com>
…fter vendoring Three CI failures introduced by dogfooding dailybot + ai-diff-reviewer: 1. Frontmatter — the ai-diff-reviewer addon description had an unquoted `five sub-skills: …` colon that broke YAML parsing. Quote the field. 2. bats catalog orphan check — dailybot and ai-diff-reviewer were on disk under .agents/skills/ but not listed in skills_agents_catalog.md. Add a "Vendored third-party skills" section and require every skill dir name to appear in the catalog (including the dogfooded packs). 3. Markdown link check — ignore two false-positive classes from vendored content we must not hand-edit: (a) dailybot's `../../../SECURITY.md` relative links that assume the upstream repo root layout, and (b) mangled URLs the checker builds by concatenating JSON metadata homepage fields with trailing YAML/JSON junk. Co-authored-by: Cursor <cursoragent@cursor.com>
This comment has been minimized.
This comment has been minimized.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
Align onboard Phase 7b and ADDONS.md with five addons, match execute detection to create/SPEC (skill + extension), document hard-fail on gh release view, add trust-boundary write scope, and refresh dogfood copy. Co-authored-by: Cursor <cursoragent@cursor.com>
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
Do not skip the local Security Review pass when a CI provider secret is unset (Flow A needs none); require fetch-depth: 0 on the fallback workflow; keep lockstep counts at every pack SKILL.md; encode skills.sh Pass posture in the review extension. Co-authored-by: Cursor <cursoragent@cursor.com>
This comment has been minimized.
This comment has been minimized.
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
Snyk E005 / Socket W012 flag the curl-to-shell literal even in MUST NOT prose; match dailybot safe wording. Clarify execute never-block applies to invocation failures only, not SR critical findings after a review runs. Co-authored-by: Cursor <cursoragent@cursor.com>
This comment has been minimized.
This comment has been minimized.
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
INTEGRATION and AGENTS.md still described Flow A as skill-only; match SKILL.md Step 0/1b. Scope the consumer AGENTS headline to invocation soft-fail. Co-authored-by: Cursor <cursoragent@cursor.com>
This comment has been minimized.
This comment has been minimized.
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
Pin Action and vendored skill to v2.0.0, document IAR + emergency-bypass label, bootstrap skip-ai-review, and align addon/SPEC/AGENTS/WORKFLOWS narrative away from the v1 pin surface. Co-authored-by: Cursor <cursoragent@cursor.com>
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
Ignore relative ../../../docs/ links from the vendored ai-diff-reviewer skill (upstream-only paths). Soften local≡CI parity claims for IAR, scope checklist never-block language, uppercase MUST, and point Flow B fallback gates at the shipped four-job pattern. Co-authored-by: Cursor <cursoragent@cursor.com>
Member
Author
|
Fixed CI markdown-link-check (vendored
Please re-toggle Ready to re-run AI review. |
This comment has been minimized.
This comment has been minimized.
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
AI review for
|
There was a problem hiding this comment.
Methodology integrity checklist
| # | Check | Result |
|---|---|---|
| M1 | Long-horizon loop intact | pass — create / execute / resume / status unchanged as the loop; addon only augments SR |
| M2 | .dwp/ durability |
pass — no change to plans/drafts/progress layout |
| M3 | Atomic task contract | pass — AC + Validation requirements untouched |
| M4 | Gate discipline | pass — soft-fail scoped to invocation failures; completed-pass criticals still follow SR contract in create / execute / SPEC §6.1–§7 |
| M5 | Mandatory finals | pass — order Security Review → Skills & Agents Discovery → Executive Report unchanged; apply-review explicitly not a plan task |
| M6 | Zero-addon baseline | pass — detection is conditional; core flows succeed with no addon |
| M7 | Interruptibility | pass — resume/progress semantics not touched |
| M8 | Spec ↔ guide ↔ create/execute | pass on normative MUST/MUST NOT (detection predicate + never-block scope align). onboard summary is incomplete vs SPEC Step 1b (see finding) but does not contradict |
Verdict
Solid addon + dogfood + pr-review.yml delivery — methodology spine and trust posture hold after the prior fix rounds. A few warnings remain on consumer onboarding completeness and a shipped template that points at a non-shipped workflow path.
Findings table
| # | Severity | File | Summary |
|---|---|---|---|
| 1 | skills/deepworkplan/onboard/SKILL.md:600 |
Onboard flow summary skips required extension bootstrap (SPEC Step 1b) | |
| 2 | skills/deepworkplan/addons/ai-diff-reviewer/templates/INTEGRATION.md:196 |
Hand-roll guidance references contributor-only pr-review.yml not in the shipped pack |
|
| 3 | skills/deepworkplan/addons/ai-diff-reviewer/SKILL.md:8 |
OpenClaw anyBins requires gh, blocking Flow A on machines without GitHub CLI |
|
| 4 | ℹ️ info | .github/docs/WORKFLOWS.md:147 |
“Same findings as CI” overclaims vs IAR (local stays full-pass) |
| 5 | ℹ️ info | AGENTS.md:442 |
Same local≡CI overclaim in the three-moment loop docs |
Notes (no inline)
- skills.sh / trust: no remote-installer pipe literals under
skills/deepworkplan/**; new addon has a Trust boundary section; core still has no network clients;--yes+-ypreserved on all three auto-release dogfoodskills addcalls. - Ship boundary: runtime artifact stays inside
skills/deepworkplan/; workflows /.review// vendored.agents/skills/*are correctly outside. - Adjacent (not in diff):
skills/deepworkplan/TRUST.mdstill lists only three addons in the opt-in caveat — worth updating in a follow-up so install-time trust copy mentionsai-diff-reviewer/design-system. - Praise: SPEC §7 / create / execute correctly split invocation soft-fail from post-run critical gating; Flow A vs B consent is first-class; four-job gate fails loud on missing
CURSOR_API_KEY.
Recommendation: request-changes
Comment on lines
+600
to
+610
| ambiguity tie-break); detect whether the vendored skill / extension file / | ||
| `pr-review.yml` already exist (reconcile-don't-clobber); offer the **opt-in** | ||
| vendored-skill install via | ||
| `npx --yes skills add DailybotHQ/ai-diff-reviewer --skill ai-diff-reviewer -y` | ||
| (both `--yes` and `-y` required); in Flow B hand off CI-workflow authoring to | ||
| the upstream `setup` sub-skill (never invent credentials — `CURSOR_API_KEY` / | ||
| provider secrets are the consumer's responsibility); wire the mandatory DWP | ||
| **Security Review** to run the upstream parent default flow as an additive | ||
| local-review pass; and (Flow B only) surface `apply-review` as an optional | ||
| developer-invoked companion during `execute`. Every **local** augmentation is | ||
| strictly **best-effort and never blocks** the work if the skill or extension is |
There was a problem hiding this comment.
Onboard’s accepted-flow summary detects an extension file and installs the vendored skill, but never tells the agent to create one via generate-extension (addon SKILL Step 1b / SPEC §4.2).
Failure mode: an agent that follows this paragraph (even after “read the addon SKILL”) can finish onboarding with skill-only install. SR detection then fails every plan (skill + extension required), so the advertised local pass never runs and agents only see “install incomplete” warnings.
Add an explicit Step 1b here: hand off to generate-extension (or hand-write .review/extension.md) before declaring the addon installed — matching SPEC “MUST NOT complete Flow A without an extension”.
Comment on lines
+195
to
+197
| must hand-roll, **mirror the shipped four-job pattern** (`scope` → | ||
| `labels-bootstrap` → `review` → stable-named `AI review gate`) from this | ||
| repo's `.github/workflows/pr-review.yml` (or the upstream `setup` wizard |
There was a problem hiding this comment.
Hand-roll fallback tells agents to mirror “this repo’s .github/workflows/pr-review.yml”. That file lives only in the contributor deepworkplan-skill tree — it is not shipped inside skills/deepworkplan/ that npx skills add installs.
Failure mode: on a consumer repo the agent Reads a path that does not exist (or invents a workflow from memory). Prefer pointing exclusively at the upstream setup wizard / setup/reference.md, or embed the minimal four-job shape in this template so the guidance is self-contained in the installed pack.
(Same issue at the later “see the shipped gate job in pr-review.yml” / “This repo’s pr-review.yml” notes.)
| documentation_url: https://deepworkplan.com | ||
| user-invocable: true | ||
| allowed-tools: Bash, Read, Grep, Glob, Edit, Write | ||
| metadata: {"openclaw":{"emoji":"🔍","homepage":"https://deepworkplan.com","requires":{"anyBins":["git","gh"]}}} |
There was a problem hiding this comment.
OpenClaw metadata requires anyBins: ["git","gh"], but Flow A (local-only Security Review augmentation) does not need the GitHub CLI. Upstream’s parent ai-diff-reviewer skill only requires git; gh is limited to open-pr / apply-review.
Failure mode: OpenClaw may refuse to load/offer this addon on machines without gh, blocking the documented Flow A path for personal repos that never touch CI.
Prefer anyBins: ["git"] (match upstream parent), and document gh as optional for Flow B companions.
| upstream skill's `prompt.md` is byte-identical to the CI Action's | ||
| `prompts/default.md` at the same tag (enforced by upstream CI's "Skills — | ||
| prompt-sync invariant" job). Consequence: running the local skill on a | ||
| branch before pushing yields the same findings CI will produce. |
There was a problem hiding this comment.
“Yields the same findings CI will produce” overstates local≡CI parity. Addon SPEC §4.3 / create already note that CI runs Iteration-Aware Review by default while the local skill stays a full pass — shared prompt.md + extension align methodology/severity, but round 2+ CI may be shorter.
Soften to “same methodology and severity model (first-pass); later CI rounds may dedupe under IAR.”
|
|
||
| 1. **Local pre-push review** (optional) — run the `ai-diff-reviewer` skill's | ||
| parent default flow (`/ai-diff-reviewer` or "Review my current branch") | ||
| before pushing. Same findings CI will produce, minus the round-trip. |
There was a problem hiding this comment.
“Same findings CI will produce” (and below, “Local ↔ CI parity is guaranteed”) conflicts with the IAR caveat already stated earlier in this section. Align with the addon SPEC softening: byte-identical prompts + shared extension guarantee methodology/severity parity, not necessarily identical finding sets after CI round 1.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Author the AI Diff Reviewer as the sixth opt-in DWP addon and dogfood it end-to-end in this repo:
skills/deepworkplan/addons/ai-diff-reviewer/(SKILL.md + 10-section RFC-2119 SPEC.md +templates/INTEGRATION.md). Deferrs install/auth/wizard to the upstreamDailybotHQ/ai-diff-reviewerskill's five sub-skills (parent default flow /generate-extension/setup/open-pr/apply-review). Two adoption flows (Flow A local-only / Flow B dual-surface); the addon MUST ask at consent time — MUST NOT default.create/SKILL.md,execute/SKILL.md,guide/GUIDE.md§5.4) so that when a target repo has the addon installed, the plan's Security Review gains a localai-diff-reviewerpass with verdict + findings table + severity, appended under a dedicated heading inanalysis_results/SECURITY_REVIEW.md. Mandatory-final-task order is unchanged. `apply-review` is documented as an optional Flow B companion duringexecute, not as a plan task file..agents/skills/(dailybotv3.10.3,ai-diff-reviewerv1.7.0) alongside the existingdeepworkplanself-dogfood copy.skills-lock.jsonis now a three-entry lockfile with SHA-256 fingerprints..github/workflows/pr-review.yml: same four-job architecture (scope / labels-bootstrap / review / gate) as the companion website PR, byte-identical config (Cursor / auto / ready / write-tier / block-on-critical), stable-namedAI review gatefor branch protection..review/extension.md(233 lines) code-anchored to this repo's four load-bearing invariants: runtime boundary (skills/deepworkplan/is the shipped artifact), auto-release ownership (bot ownsversion:andCHANGELOG.md), addon contract (opt-in, reconcile-don't-clobber, never-block), vendor-neutrality (core methodology has zero addon dependency).auto-release.ymlnow refreshes.agents/skills/{deepworkplan,dailybot,ai-diff-reviewer}/at each release, with the mandatory--yes+-ynon-interactive contract preserved on all three invocations.Companion PR in the website repo: DailybotHQ/deepworkplan-website#feat/add-ai-diff-reviewer-addon — installs and dogfoods the addon this PR authors.
Documentation
AGENTS.mdgains three new sections: "Vendored agent skills — three dogfood copies", "PR review workflow — Cursor-based,ready-label gated", and "Theai-diff-revieweraddon (opt-in, DWP-adjacent)" — the last clarifies the distinction between the vendored skill at.agents/skills/ai-diff-reviewer/(general-purpose) and the DWP addon atskills/deepworkplan/addons/ai-diff-reviewer/(what onboards it into a plan)..github/docs/WORKFLOWS.md(200 lines) covers all three workflows (auto-release,ci,pr-review) with Trigger / Jobs / Gate semantics / Failure modes / interactions / External Actions / Secrets.addons/README.mdupdated to list the new addon alongside the existing five.Guarantees preserved
--yesand-yflags present on every realnpx skills addinvocation (upstream v1.7.0 bug-fix regression guard — dropping either flag hangs a non-TTY runner).skills/deepworkplan/, no dev-infra file added inside it.Required secret
Register
CURSOR_API_KEYin Settings > Secrets and variables > Actions before applying thereadylabel to any PR.Test plan
CURSOR_API_KEYin repo settings.readylabel to this PR — verify the four-job sequence completes.AI review gateturns green (or fails cleanly withcriticalfindings surfaced inline).main— verifyauto-release.ymlproduces version bump + tag + up to threechore(release): dogfood vendored <skill> to v<tag> [skip release]commits (one per moved skill).name, quotedversion,documentation_url).bats tests/andshellcheck setup.sh skills/deepworkplan/shared/context.sh— no regressions expected (this PR adds no shell code).Follow-up (out of scope for this PR)
Two cross-repo recommendations recorded in the website's plan Skills & Agents Discovery report:
install_and_verify()(currently in the website'srelease_and_publish.yml) intoskills/deepworkplan/shared/install-vendored-skill.shas a reusable Bash helper for every DWP-adopting repo.skills/deepworkplan/addons/README.md, now that three addons share the pattern (dailybot,design-system,ai-diff-reviewer).Both are documentation-scale changes for a follow-up plan.
Made with Cursor