openlore-review-changes

openlore: Review Changes

When to use this skill

Trigger this skill whenever the user asks to review, audit, or check the safety of recent changes, with phrasings like:

• "review my changes"
• "what did I break?"
• "is this branch safe to merge?"
• "pre-PR check"
• "what's risky in this diff?"
• "check the blast radius of my changes"
• explicit command /openlore-review-changes

No code is written. Output is a risk-ranked review with a go/no-go recommendation.

---

Step 1 — Confirm directory and base ref

Ask: which project? Diff against which base? (default: main)

Store as $DIRECTORY and $BASE_REF.

---

Step 2 — Detect changed functions and risk scores

Call the openlore MCP tool detect_changes with:

{"directory": "$DIRECTORY", "base": "$BASE_REF"}

The risk score is multiplicative: likelihood × impact.

• likelihood = how much was changed × how poorly covered it is ("called" tests count full; "imported"-only count 0.3×)
• impact = structural blast radius (log fanIn + distance-weighted transitive callers weighted by callType + external boundary calls)

A function with fanIn=0 calling nothing external scores 0 regardless of change size — correct; focus on non-zero scores.

Present a risk-ranked table:

Rank	Function	File	riskScore	blastRadius	fanIn	testedBy

Flag:

• riskScore ≥ 5 → 🔴 HIGH — must inspect
• riskScore 2–5 → 🟡 MEDIUM — inspect if time allows
• riskScore < 2 → 🟢 LOW

---

Step 3 — Deep-inspect each HIGH function

For each function with riskScore ≥ 5, call get_minimal_context:

{"directory": "$DIRECTORY", "functionName": "$FUNCTION_NAME"}

What to read:

• function.riskLevel — "high" means the tool expanded caller/callee lists to 24. All shown entries are in the blast radius.
• callers[*].callType — all "awaited" = async interface frozen; any signature change breaks every caller without a compile error in JS. Mixed = looser coupling.
• callees[*].isExternal: true — function touches an external boundary (HTTP/DB). Failures here propagate outward and may not be caught in unit tests.
• testedBy[*].confidence — "called" = direct test (strong safety net). "imported" = test file only imports the module; vi.mock() can neutralize it entirely. Only "imported" = effectively untested.