talos-mcp-server: Skill for Claude Code

Guard Mutating Tool

Scan the current diff against the CLAUDE.md § Safety matrix (cached in references/guard-matrix.md) and emit a structured report the staff-reviewer agent can consume directly.

Arguments

Parse $ARGUMENTS:

• --base <ref> — base ref for the diff. Defaults to origin/main.

Validate the base ref:

git rev-parse --verify "${BASE:-origin/main}" >/dev/null \
  || abort "Unknown base ref: $BASE"

Key Steps

1. List changed mutating-tool files.

   git diff --name-only "${BASE:-origin/main}"...HEAD -- 'internal/tools/*.go'
   

   Filter by basename to one of: lifecycle, files, patch_blocklist, or any *_preflight (files that implement reboot, upgrade, rollback, reset, patch_config, apply_config, or preflight helpers that gate those mutations). Exit early with verdict GO if the filtered list is empty.

2. Load the guard matrix. Read references/guard-matrix.md. Its required_args and default_values columns are the ground truth.

3. Scan each file for guard presence. For every matched file:

   git diff "${BASE:-origin/main}"...HEAD -U3 -- <file> \
     | grep -nE 'confirm|nodes|dry_run|preserve|graceful|wait'
   

   Cross-reference the hunks against the matrix row for the tool.

4. Classify each guard. Flag a regression when:

   • a required-arg check was removed (deletion of if !confirm / len(nodes)==0),
   • a default literal changed (e.g. dry_run: true → dry_run: false),
   • a new control-flow path reaches the mutating gRPC call without passing through the guard check.

4b. Preflight helper check. For any *_preflight.go in the filtered set, load .claude/rules/quorum-member-counting.md and apply its invariants against the diff (dedup by member Id before counting, map[<id-type>]struct{} structure, no reliance on len(msg.GetMembers())). Flag as regression if a preflight helper is introduced or modified without the dedup pattern.