.roborev.toml

review_guidelines = """
kenn-forge is a local-first, single-user tool that binds to loopback
(127.0.0.1) by default. There is no multi-user authentication or
session management by design. All API endpoints -- including mutation
endpoints like merge, approve, comment, close, and reopen -- share the
same trust model: the user who started the server is the only intended
consumer.

Do not flag the absence of request-level authentication, authorization,
or CSRF protection on API endpoints. This is an intentional architectural
decision, not a missing feature.

Repository skills under `skills/` are local maintainer tools, not shipped
features or hosted services. Apply the trust boundary in each `SKILL.md`. A
workflow that already runs an approved checkout does not gain more access by
displaying that checkout's output in a loopback-only viewer.

Report security findings only when a skill accepts unapproved external input,
listens beyond loopback, publishes artifacts, or accesses undeclared state.
Correctness, data loss, and unsafe shell behavior remain in scope.

The root-level kenn-forge package (forge.go) is the embedding API.
It does not have a stable API and can be changed arbitrarily until it
stabilizes. Do not flag breaking changes to its exported surface.

Dated design, specification, and implementation-plan documents are historical
artifacts once the PR that introduced them has landed. Outside the PR that
creates a specific document, do not recommend editing it to reflect later
implementation decisions, review findings, or current behavior. Preserve the
original record and put superseding decisions in a new dated design document,
ADR, or the appropriate living context document instead. Flag later PRs that
rewrite these historical artifacts unless the change is explicitly correcting
the record itself.

Resource ceilings bound accepted or retained data, not peak process memory;
transient processing amplification is acceptable. Do not demand finer
allocation accounting without an unbounded input or observed problem.

Use the narrowest test lane that can catch the regression. Use pure Go tests
for HTTP API, SQLite, persistence, sync, middleware, and wire-serialization
behavior. Use TypeScript and jsdom tests for frontend-owned workflows, route
state, callbacks, and interaction logic.

Require Playwright only when correctness depends on an actual rendered browser
surface: viewport or layout behavior, computed visual styles, clipping or
overflow, drag/scroll geometry, screenshots, canvas/xterm rendering, or a
browser-engine difference that jsdom cannot model.

Do not require Playwright or full-stack coverage for UI-owned data flow,
callback handoff, hidden or disabled states, menu contents, or route-derived
view state when a focused component or store test exercises the real subject
and observes the result. A jsdom test may cover an entire frontend-owned flow
end to end; do not reject it merely because it does not use Playwright.
Existing higher-level coverage can protect the surrounding workflow; do not
demand a duplicate Playwright test for route changes or multi-step frontend
logic that jsdom can drive.

Treat missing required boundary coverage as at least MEDIUM severity.
Treat it as HIGH severity when the uncovered change affects core
maintainer actions, regression-prone flows, or bug fixes where the lack
of a suitable test could allow a user-visible breakage to ship.

Do not demand Playwright merely because kenn-forge has Playwright
infrastructure. The test must need real rendering or browser-engine behavior.

Do not require duplicate e2e coverage for default-host and
`/host/{platform_host}` routes when the host route is only a generic
wrapper. Require host-specific e2e only for custom host logic, route
parsing, or provider identity changes.

kenn-forge targets Go 1.26, where the built-in new accepts expression
operands such as new(expr). Do not flag new(expr) usage as invalid,
suspicious, or something that must be rewritten through a temporary
variable solely because older Go versions did not allow it.

Disregard findings whose only substance is that the code does not
compile or type-check. kenn-forge has static tests for that already.
"""