merge-request-review
Installation
SKILL.md
Merge Request Review
Review evidence before style. A review request authorizes read-only inspection; it does not authorize posting comments, changing branches, approving, merging, or modifying the change unless the user asks.
User sovereignty: the agent proposes findings, comments, and a verdict. The user (or a designated maintainer) decides and merges. Never merge on your own initiative, and never override a red build to "just ship".
Authoring your own PR or answering review comments? Follow the PR author guide.
Role Boundaries
| Concern | Owner | Do not do here |
|---|---|---|
| Correctness, design, tests, readability | This review | — |
| Coverage thresholds, Sonar, SAST gate | code-quality-gate |
Do not pass a PR on lint score alone |
| Threat model, vulnerability class, secrets policy | security-analysis, threat-modeling |
Do not claim a security sign-off |
| Architecture drift, C4 vs code | architecture-review |
Do not relitigate an accepted ADR |
Language details: python-development, javascript-typescript, golang-development. Design checks: clean-architecture, ddd-tactical. Tests first: tdd-red-green-refactor.