semantic-slicing

Semantic Slicing

Purpose

Turn a large repo into reviewable semantic slices with evidence. Use code shape, threat candidates, issue clusters, and support chatter together so review budget lands on the right parts of the system.

Default stance: map locally first, rank second, spend agent/security-review budget last.

When to use

• Setting up or running openclaw/clawpatch against a target repo.
• Setting up or running vercel-labs/deepsec against a target repo.
• Producing a local visual map of feature slices, risky files, ownership clusters, or review targets.
• Cross-checking code slices against gitcrawl issue/PR data or discrawl Discord/support data.
• Planning a focused security, regression, architecture, or maintainer-review pass for a large repo.

Workflow

1. Reuse suitable tool state. Create task-owned temporary storage only when a tool requires files.
2. Read target repo instructions before scanning. For OpenClaw, read root AGENTS.md; subtree guides matter when reviewing a slice.
3. Verify tool setup:
   • clawpatch: clone/build openclaw/clawpatch, then run clawpatch init, clawpatch map, clawpatch status.
   • deepsec: clone/build vercel-labs/deepsec, scaffold a scratch workspace, then run deepsec scan.
   • gitcrawl: run gitcrawl doctor --json, then pull clusters/threads for related issue evidence.
   • discrawl: run discrawl doctor --json and discrawl status --json; use search/digest only when support chatter is relevant.
4. Run deterministic maps before AI review:
   • Clawpatch feature map for entrypoints/packages/config/test slices.
   • Deepsec regex scan for candidate threat surfaces.
   • Optional repo git overlay for CODEOWNERS routing, tracked files, code/test/doc shape, and recent churn.
   • Optional gitcrawl/discrawl lookups for historical pain around the same files, components, or symptoms.
5. Run scripts/semantic-map.mjs to merge the evidence into JSON on stdout.
   • Select bounded fields for agent inspection. Do not save intermediate output by default.
   • Use --out <path> only for a requested deliverable or required evidence. It retains HTML and JSON by default.
   • Use --format html|json|both to select output. A single format writes only the exact --out path.
   • Sparse mode is on by default and omits dotfile/config trees, docs, changelog files, and mobile app trees so core review stays focused.
   • Use --no-sparse or --sparse false for the full repo; use --sparse-exclude <csv> and --sparse-include <csv> to tune the filter.
6. When a visual board is requested, review it in product order:
   • review lanes first: semantic shape, ownership routing, development pressure, security pressure, issue pressure, support pressure,
   • focus controls second: lens and system filters that narrow the matrix without duplicating rows,
   • overall lens matrix third: the single slice-row table with comparable bars for semantic, ownership, development, security, issue, and support lenses,
   • agent handoff packet fourth: compact JSON for follow-up agents,
   • evidence tables last: raw-ish overlays for audit, not the primary reading path.
7. Choose a cost size before running AI stages:
   • low: deterministic maps only; no deepsec process or real clawpatch review.
   • medium: one to three explicit files/features with high-risk slugs, batch size 1, concurrency 1, and a turn cap.
   • high: broader AI processing or multiple feature reviews; requires an explicit budget/time decision.
8. Run AI only at the chosen size:
   • clawpatch review --feature <id> or a small --limit.
   • deepsec process --files <csv> or tightly scoped --filter plus --only-slugs.
9. Report retained paths, run IDs, counts, cost size, exclusions, and skipped expensive stages in chat. Remove only task-owned disposable scratch when no longer needed or in use. Preserve named deliverables and recovery evidence.