← ClaudeAtlas

id-reviewlisted

The infra-delivery two-lens advisory review procedure the generic agent runs at the infra-delivery review step (/foundry:id-review, infra-delivery review step / step 10 — the sd-review analog for infra). A PROCEDURE — it DISPATCHES the MERGED pr-reviewer general code lens (agents/pr-reviewer.md) ALWAYS, plus the security-reviewer security lens (agents/security-reviewer.md) WHEN the change touches auth/IAM, secrets/credentials, or supply-chain/dependencies, feeding both the infra context — the diff + the change's POLICY-RISK findings (parse_policy_findings) + the plan actions_detail ({address, action}) — as plan-as-DATA, then collates the categorized findings for the operator and surfaces the policy:high-blast-ack extra-approval expectation for the operator/reviewer to weigh (the bespoke merge-gate machinery that once re-derived this automatically was retired). It does NOT re-implement review (the agents own the review craft). Advisory, read-only: it surfaces findings; it does NOT gate, approve, or merge — the
lukasrepublic/agentic-foundry · ★ 1 · AI & Automation · score 67
Install: claude install-skill lukasrepublic/agentic-foundry
# /foundry:id-review — the infra-delivery two-lens advisory review procedure (general always + security on high-risk, over diff + plan-as-DATA + policy-risk findings) The `infra-delivery` step sequence (a documented procedure this skill family forms — no workflow engine or state-machine file ships)'s **review** step (step 10) — the infra analog of `sd-review`. A separate-context, infra-specific **mistake-catcher** pass over an infra change BEFORE the merge pivot. Without a procedure the implementing agent reviews in its own already-biased context, runs a single ad-hoc pass, forgets the security lens on an IAM-policy / connection-string / provider-bump change, misses that a plan REPLACE/deletes a stateful resource, or (worst) treats its own advisory review as if it were an approval to merge. This skill is the disciplined procedure the agent runs instead: it **dispatches the two MERGED review lenses** — the general code lens **always**, the security lens **when the change is high-risk** — feeds them the **infra context** (the diff + the change's **policy-risk findings** + the plan's **`actions_detail`**, all as **plan-as-DATA**), collates their categorized findings for the trusted operator, and **surfaces the extra-approval expectation** for the operator/reviewer to weigh at the merge floor. It defines **no reviewer of its own**; the `pr-reviewer` and `security-reviewer` agents own the review craft. ## When to trigger - An infra atom's implementation is complete and the chan