Add skill and Cursor engine for local adversarial review

[d-morrison]

Implements the adv adversarial code review skill and extends scripts/pre-push-review.py with Cursor CLI support and automatic fallback logic. Also addresses multiple critical findings from self-review, including robust head SHA tracking, safe GitHub PR commenting, strict section matching, and invoking agent filtering for true model independence.

[cursor]

Independent adversarial review of HEAD 62c9fda08c21b34d75fd5e194ef363e0ea0eb121. First review of this PR.

Parser probes were executed in memory against this blob. Claude skip notices on sibling PRs are not reviews of this HEAD.

Findings

1. [Defect] scripts/pre-push-review.py — HTML comments are never stripped; section presence is a substring test. A report whose entire clean skeleton lives inside <!-- ... --> is admitted. Probe: HTML-comment-only structure → valid=True clean=True. Sibling #2251 already strips comments and anchors headings.

2. [Defect] Qualifier after [-:—(] is discarded. Probe: Ready for merge — except the tests fail and do not merge and Ready for merge (do not merge) both return CLEAN. The unit test encodes the hole: a rationale after an em-dash is asserted clean.

3. [Defect] The prompt example Verdict: Ready for merge (or Verdict: Needs work with concise reason) splits on ( to ready for merge. A model that echoes the instruction line is graded CLEAN and stops the fallback chain.

4. [Defect] Cursor engine: official --print has write/shell tools; --trust skips the workspace prompt. The skill says the auto chain runs in plan/read-only mode. --model is appended after the positional prompt, so it is swallowed as prompt text. detect_available_engines inserts cursor ahead of codex. Tests never invoke run_cursor_review.

5. [Factual Error] Skill and Conductor spec describe auto priority claude -> codex -> opencode -> agy. Implementation and argparse help are claude -> cursor -> codex -> opencode -> agy.

6. [Factual Error] OpenCode pipes a tempfile on stdin with no positional message. This repo's measured opencode run contract (2026-08-19) takes the message as positional arguments. Default --engine opencode-zen is zen/free, which is not a measured provider/model id.

7. [Defect] Merge order vs still-open #2251: overlap is 18 paths, including all of conductor/ and scripts/pre-push-review.py. Neither head is an ancestor of the other. Merging either first conflicts on the shared files.

8. [Convention] Literal U+2014 in scripts/pre-push-review.py and three test fixtures. shared/coding/ascii-punctuation-in-source.md requires \u2014.

9. [Edge Case] --post is not gated on is_clean/is_valid. It is gated on headRefOid == local HEAD, so the advertised pre-push path (unpushed commits) cannot post. Empty diff exits 0 (vacuous CLEAN). HEAD~1 fallback reviews only the last commit of an N-commit branch.

Verdict: Needs more work

Reviewed-Commit: 62c9fda

Posted by Cursor Grok 4.6 (AI agent) --- not written by a human.

[d-morrison]

@claude review

[github-actions]

👀 Picked up by workflow run #32946854685. Setup runs first; Claude itself responds after that.

[github-actions]

Warning

No review ran --- this PR edits .github/workflows/validate.yml.
claude-code-action requires workflow files to match the default branch on dispatched runs, so its token exchange fails until this change merges.
The review is skipped by design, and re-running or re-dispatching will not change that: the skip lifts only if the PR stops editing that file.

require-review reports a gray skipped rather than green.
A green there attests that a reviewer ran, never that one approved; here none ran at all.
Merge on a self-review or a human review instead.

View run

[d-morrison]

Local Adversarial AI Review (Cursor Agent)

Reviewed Commit: 7dd5f9759c6b8c79beb687dea0000ddea2bba7ec

Summary Verdict

Verdict: Needs work with two contract-level regressions: the new skills are not registered on the Antigravity/Gemini workspace-discovery surface, and pre-push-review.py can silently review the wrong diff when the PR base branch is not present locally.

Critical Findings

1. The new adv / pre-push-review skills are not wired into the workspace manifest that Antigravity/Gemini uses to discover repo-local skills, so one advertised harness never sees the feature at all.

   The repo explicitly documents .agents/skills.json as the workspace-plugin discovery point:

- **Global Plugin**: `bootstrap.sh` symlinks `plugins/ai-config` to `~/.gemini/config/plugins/ai-config` and registers `~/.gemini/config/plugins.json` and `skills.json`.
- **Workspace Plugin**: Opening this repository directly in Antigravity automatically discovers `.agents/skills.json` and `.agents/plugins.json` to load all skills, rules (`AGENTS.md`), and plugin features.

But this diff only adds skills/adv/SKILL.md, skills/pre-push-review/SKILL.md, and the generated Codex wrappers; it does not update .agents/skills.json. That means the feature is missing on the exact discovery path the repo claims for Antigravity/Gemini workspaces. The conductor spec even says this registration should happen, so this is not just documentation drift.

2. resolve_diff() does not fetch or require the PR's actual base ref; if that branch is not already present locally, it silently falls back to origin/main / main and reviews a different diff than the PR is based on.

def resolve_diff(head_sha: str, pr_number: Optional[int] = None, explicit_base: str = "") -> Tuple[str, str, str, str]:
    """Compute local git diff against the PR base branch or default main.

    Always diffs the provided head_sha to include unpushed commits.
    """
    base_ref = explicit_base
    if not base_ref and pr_number:
        pr_base = get_pr_base_branch(pr_number)
        if pr_base:
            for cand in [f"origin/{pr_base}", pr_base]:
                r = subprocess.run(["git", "rev-parse", "--verify", cand], capture_output=True, text=True)
                if r.returncode == 0:
                    base_ref = cand
                    break

    if not base_ref:
        for cand in ["origin/main", "origin/master", "main", "master"]:
            r = subprocess.run(["git", "rev-parse", "--verify", cand], capture_output=True, text=True)
            if r.returncode == 0:
                base_ref = cand
                break

That violates the skill's own contract to review against "the detected PR base / explicit base branch":

## How it works

1. Computes the local outgoing diff against `origin/main` (or the detected PR base / explicit base branch).
2. Injects universal repository standards (`AGENTS.md`).
3. Dispatches to the selected engine or auto-fallback chain in plan/read-only mode (`claude` -> `cursor` -> `codex` -> `opencode` -> `agy`), or alternates round-robin across available models.
4. Strictly parses and validates structured findings (Summary Verdict, Critical Findings, Observations, Verification Steps, and Reviewed-Commit SHA).
5. Exits nonzero on blocking `Needs work` findings (unless `--allow-findings` is specified) and optionally posts verified review notes directly to the GitHub PR.

On a PR retargeted to a release branch, or on any checkout that has not fetched the base branch yet, the tool will produce and optionally post a verdict for the wrong change set.

Observations & Non-Blocking Suggestions

[MINOR] The new conductor/ docs introduce workflow rules like "plan.md is the source of truth" and mandatory per-task commits/git-notes that are not referenced anywhere else in the repo and conflict with the existing universal workflow in AGENTS.md. If they are meant to be advisory notes, link them from an owning doc; if they are meant to be active policy, they need a clearly defined loading/activation path.

[MINOR] skills/pre-push-review/SKILL.md and its frontmatter describe the supported engines inconsistently: the implementation supports cursor, but the frontmatter description and the "Explicitly choose AI engine" text omit it. That will mislead users even if the code path works.

[INFO] The added CI coverage is useful, but it only exercises mocked subprocess boundaries. The two regressions above both live in integration seams the unit tests currently do not pin: manifest registration for workspace discovery, and PR-base resolution when the remote base ref is absent locally.

Verification Steps

1. Compared the new skill/docs claims against the repo's existing installation and discovery documentation in README.md.
2. Inspected scripts/pre-push-review.py for diff-base resolution, engine selection, report validation, and PR-posting behavior.
3. Cross-checked the new skill files against the implementation contract they advertise.
4. Looked for surrounding validator/generator coverage to see whether these failure modes would be caught automatically.

Reviewed-Commit: 7dd5f97

---

Posted by Cursor Agent (AI agent) --- not written by a human.

[github-actions]

Warning

Claude review skipped — API credential or quota unavailable. No CLAUDE_CODE_OAUTH_TOKEN or ANTHROPIC_API_KEY secret is configured, or account API quota is exhausted. Re-trigger the review by pushing a new commit or re-running the workflow once configured/reset. View run

[github-actions]

Warning

Claude review skipped — API credential or quota unavailable. No CLAUDE_CODE_OAUTH_TOKEN or ANTHROPIC_API_KEY secret is configured, or account API quota is exhausted. Re-trigger the review by pushing a new commit or re-running the workflow once configured/reset. View run

[github-actions]

Warning

Claude review skipped — API credential or quota unavailable. No CLAUDE_CODE_OAUTH_TOKEN or ANTHROPIC_API_KEY secret is configured, or account API quota is exhausted. Re-trigger the review by pushing a new commit or re-running the workflow once configured/reset. View run

[github-actions]

Warning

Claude review skipped — API credential or quota unavailable. No CLAUDE_CODE_OAUTH_TOKEN or ANTHROPIC_API_KEY secret is configured, or account API quota is exhausted. Re-trigger the review by pushing a new commit or re-running the workflow once configured/reset. View run

[d-morrison]

Local Adversarial AI Review (Cursor Agent)

Reviewed Commit: eeaf4501853760d5774c99f6ebf463a0fd0cd71d

Summary Verdict

Verdict: Needs work — alternate-mode --exclude-engine / $AGENT_NAME resolution hard-fails or mis-maps engines on the skill’s documented invocation path.

Critical Findings

1. execute_review("alternate") invoker exclusion is unsafe and disagrees with the skill wrappers. In scripts/pre-push-review.py, unknown exclude strings are resolved with if k in inv over short aliases (auto, agy, dto, dtc, codex, …), then if exclude_engine and not recognized: return None. Effects:
   • Hard fail: skills/adv/SKILL.md / skills/pre-push-review/SKILL.md always pass --exclude-engine "$AGENT_NAME" when set. Values like Gemini, human, or other non-alias names abort the review even when other engines are available. test_alternate_proceeds_without_invoker only covers AGENT_NAME=human without --exclude-engine, so it misses the skill’s real call shape.
   • Wrong engine excluded: "codex" in "…opencode…" is true, so non-exact OpenCode-like names exclude codex; "agy" in "agency" / "auto" in "automation" similarly mis-exclude antigravity/cursor.
   • Fix: exact/canonical match only (tokenized), never raw substring; treat unrecognized --exclude-engine as warn+ignore or require a known canonical id; add tests that mirror the skill’s AGENT_NAME → --exclude-engine path.

Observations & Non-Blocking Suggestions

[MINOR] .agents/skills.json adds skills/adv and skills/pre-push-review while skills already covers them; redundant and may confuse discovery that expects a directory-of-skills layout.

[MINOR] Auto-mode “no CLI found” message omits cursor/agent even though detection priority includes it.

[MINOR] Cursor runner uses --trust while claiming plan-mode isolation; residual tool-use risk beyond deleting repo-local agent configs.

[INFO] Conductor track plan.md still describes engine order agy -> claude -> codex; code/spec/skill use claude -> cursor -> codex -> opencode -> agy.

[INFO] --post correctly fail-closes unless local HEAD equals remote PR head; primary pre-push use is local-only (documented weakly).

[INFO] Verdict parsing, SHA fingerprinting, fence/comment stripping, and forge disclosure (no robot emoji; marker sanitization) look solid and well-tested.

Verification Steps

• Diff reviewed: PR Add skill and Cursor engine for local adversarial review #2255 vs origin/main at eeaf4501853760d5774c99f6ebf463a0fd0cd71d
• Cross-checked execute_review alternate exclusion against skill bash and scripts/test_pre_push_review.py
• Cross-checked posting path vs scripts/check-pr-fully-clean.py admission rules (human-authored clean comments are not treated as automated clean reviews)
• Confirmed scripts/lib/fences.py exists for the new import

Reviewed-Commit: eeaf450

---

Posted by Cursor Agent (AI agent) --- not written by a human.

[github-actions]

Warning

Claude review skipped — API credential or quota unavailable. No CLAUDE_CODE_OAUTH_TOKEN or ANTHROPIC_API_KEY secret is configured, or account API quota is exhausted. Re-trigger the review by pushing a new commit or re-running the workflow once configured/reset. View run

[github-actions]

Warning

Claude review skipped — API credential or quota unavailable. No CLAUDE_CODE_OAUTH_TOKEN or ANTHROPIC_API_KEY secret is configured, or account API quota is exhausted. Re-trigger the review by pushing a new commit or re-running the workflow once configured/reset. View run

[github-actions]

PR Preview Action v1.8.1
Preview removed because the pull request was closed.

_{2026-08-26 10:40 UTC}

[d-morrison]

Local Adversarial AI Review (Google Antigravity)

Reviewed Commit: 6d5d07341827d4bfa9b9ba51293ad72979dd6c42

Summary Verdict

Verdict: Ready for merge

Critical Findings

None.

Observations & Non-Blocking Suggestions

• [INFO] Engine Detection & Fallback: The auto-detection priority order (claude -> cursor -> codex -> opencode -> agy), rotation persistence via ~/.gemini/pre_push_review_state.json, and invoker exclusion logic prevent recursive self-invocation and gracefully degrade across available CLIs.
• [INFO] Sandbox Isolation: Executing reviews inside an ephemeral shared worktree clone with repo-controlled agent configurations stripped (.claude, .cursor, .agents, etc.) mitigates malicious prompt injection vectors from untrusted diffs.
• [INFO] Strict Verification & Attribution: SHA validation across local/remote PR heads prevents posting review findings against mismatched revisions, and forge comments adhere strictly to lab disclosure conventions without forbidden emoji markers.
• [INFO] Argument Limits: Argument length gating (len(prompt.encode('utf-8')) > 800000) for CLI engines that accept prompts via command arguments prevents OS ARG_MAX / E2BIG buffer overflow errors on large diffs.

Verification Steps

• Verified comprehensive unit test coverage in scripts/test_pre_push_review.py testing CLI dispatch contracts, prompt construction, verdict parser semantics, and error handling.
• Audited canonical skill definitions (skills/adv/SKILL.md, skills/pre-push-review/SKILL.md) and verified parity with generated Codex wrappers in codex-skills/.
• Verified CI workflow wiring in .github/workflows/validate.yml.

Reviewed-Commit: 6d5d073

---

Posted by Google Antigravity (AI agent) --- not written by a human.