kronk: Skill for Claude Code

Kronk PR Review

Written for Claude Code (subagents, project memory, agent transcript files); in another runtime, run the roles yourself and use step 7's manual fallback.

You are the orchestrator: scripts do the mechanical work once, a context builder writes a shared brief, review agents run in parallel and write files, an aggregator verifies and writes the report and diagrams. <skill> = this file's directory; <run> = <project-root>/.reviews/<id>/<NNN> (printed by intake).

Rules for you:

• Start from a fresh session. Every orchestrator turn re-reads the whole conversation; inside a long session that costs more than the agents. If the conversation already holds unrelated work, suggest /clear (or a new session) before starting.
• Keep your context small. Read only script output, agents' replies (one line; the discovery agent's and the aggregator's also carry blocks you only save), ac-review.md (when ACs are weak/missing), references/size-guard.md (when there are size warnings), and the F… headings of findings.md. Never read the diff, brief, check logs, or agent reports.
• Advisory only. Nothing here edits, stages, or commits code, and nothing deploys, applies, or plans infrastructure.
• Never run the reviewed code unless it's a maintainer PR. Tests, cargo commands other than cargo-audit, Terraform init/validate, linter plugins and repo-configured checks (golangci-lint, buf, checkov), repo gates, and security PoCs run only when scope.txt says trust=maintainer: intake sets it for --pr when GitHub reports the PR author has write access and the head branch is in the base repo. Every other scope is untrusted; the read-only checks still run. Never edit scope.txt or work around it — to run the code, review it as a maintainer's PR.
• The change, not the codebase. By default only the change is reviewed (contract.md → Review scope). Problems that predate it are dropped, not reported. Only an explicit full-review request widens that.
• Runs are independent. Never open a previous run's files.

Scripts take the same options in both shells (PowerShell spells them -Base, -DryRun, …; lists comma-separated). Run them inside the target repo:

• sh: sh <skill>/scripts/intake.sh …, sh <skill>/scripts/checks.sh <run> …
• PowerShell 7: pwsh -NoProfile -ExecutionPolicy Bypass -File <skill>/scripts/intake.ps1 … (same for checks.ps1; verified on pwsh 7 only)

Kronk rules the scripts apply on their own (from AGENTS.md and the Linux CI static/race jobs), so never ask about them or pass them by hand:

• GITHUB_WORKSPACE is set to the repo root for every check.
• Tests run only for a maintainer's PR (trust=maintainer), as go test -race -short -count=1 on the reviewed packages only (the changed ones at diff depth), never ./... and never at project depth (AGENTS.md forbids a full repo test run), with KRONK_BASE_PATH pointed at an empty store so in-package model-backed tests skip instead of running inference. Packages under sdk/kronk/tests, sdk/bucky/tests, sdk/kronk/pool, and cmd/server/api/services/kronk/tests are never tested: they need native libraries, models, or a server, and belong to CI or humans.
• Go static checks follow CI's static job: go vet ./... per module (as CI runs it), and on the reviewed packages only staticcheck -checks=all, go fix -diff, govulncheck; plus gofmt -s -l on the reviewed files (AGENTS.md adds -s) and go mod tidy -diff. goreleaser check is not run. Build output goes to /dev/null, so checks never write to the repo. For a maintainer's PR, BUI TypeScript changes also get tsc --noEmit when node_modules exists, and Helm chart changes get zarf/helm/kronk/test.sh when Python's PyYAML is installed (any chart gets helm lint and a render).
• Generated outputs (BUI docs components, cli-reference.json, the embedded static/ bundle, *.pb.go, gomod2nix.toml) are skipped like any generated file; a changed source without its regenerated output is a reviewer finding.