iroha-reviewlisted

The self-review pipeline for this repository — the only one. Targets committed changes (default: everything since the merge-base with main), reviewing them through a multi-stage pipeline: deterministic checks (lint/typecheck/test/build/secret grep) → launch fresh-context reviewers (security-reviewer / spec-compliance-reviewer / adversarial-reviewer, plus security-diff-reviewer when the diff touches packages/git, packages/forge*, or packages/adapter-*) in parallel → reproduce-and-verify HIGH/CRITICAL findings with finding-validator. Can be invoked at any time, with or without a PR, and is what to run before pushing a fix to a security-sensitive package. If the working tree has uncommitted changes, use AskUserQuestion to confirm whether to include them. No commit, push, or PR creation — its only write is the PR-comment draft inside `.git/`, which is never committed. fail-open (this skill itself does not block the merge; it only reports findings). Invoked by "self-review this", "review this", or "/iroha-review".
iroha924/iroha · ★ 0 · Code & Development · score 67

Install: claude install-skill iroha924/iroha

# iroha-review — whole-project self-review The one review pipeline for this repository: it targets the entire iroha monorepo, can be invoked at any time, and deepens itself for a security-sensitive diff rather than deferring to a second skill (Step 3). It is designed on the basis of the state of the art as of July 2026 (independent review by each specialist agent → per-finding adjudication is the most effective way to suppress false positives) and of `~/.claude/rules/code-review-triage.md` (verification by reproduction). The *thinking* that belongs before a security-sensitive change — what a pattern change newly lets through, whether a fix generalizes to sibling call sites, which platform behavior a hand-rolled replacement drops, whether the value can simply be left out — lives in the path-scoped rules, which auto-load whenever you open a matching file: `.claude/rules/secure-subprocess-and-credentials.md` and `.claude/rules/path-and-symlink-safety.md`. This skill is the mechanical pass that runs after the change is written; it does not restate those rules. ## Approach - **By default, only committed changes are in scope**. If there are uncommitted changes, always confirm with the user (do not include or exclude them on your own). - **One write, nothing else**. The only file this skill creates is the Step 6 PR-comment draft inside `.git/`, which is never committed. Do not create state files like `.mumei`, and do not commit, push, or create a PR. - **fail-open**. This skill