菜单
Posts finalized review comments to GitHub, leaving the review pending by default or submitting it under explicit verified authorization.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/lossyrob/phased-agent-workflow --skill paw-review-github命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Transforms evaluation findings into structured review comments with comprehensive rationale. Handles both initial draft generation and critique response iteration.
Analyzes PR changes to create ReviewContext.md and DerivedSpec.md artifacts. Handles both initial analysis and resumption after baseline research.
Orchestrates the PAW Review workflow, coordinating activity skills to analyze PRs and generate comprehensive review feedback.
正在显示 SKILL.md
| name | paw-review-github |
| description | Posts finalized review comments to GitHub, leaving the review pending by default or submitting it under explicit verified authorization. |
Post finalized comments to a GitHub review. Pending is the default. Submission is a separate authorized mutation with fail-closed target and head verification.
Reference: Follow Core Review Principles and Authorization Preflight from
paw-review-workflow.
Read both artifacts from .paw/reviews/<identifier>/:
ReviewComments.md
finalized**Final**: markerReady for GitHub postingReviewContext.md
Review Platform: githubPreflight Status: passedIf these conditions fail, report the exact blocker. Do not create or submit a review.
For Azure DevOps or local contexts, skip GitHub mutations and use the artifact-only flow.
| Condition | Action |
|---|---|
Authorization absent; action pending | Create or reuse a pending review, then stop |
Explicit authorization; action submit | Create or reuse the exact pending review, verify the authorization tuple, then submit |
| Authorization ambiguous or preflight blocked |
| Stop before mutation and report the conflict |
| Requested mutation unavailable | Preserve artifacts and report capability unavailable |
| Review already submitted | Report the terminal state; do not replay |
Allowed submission events are APPROVE, REQUEST_CHANGES, and COMMENT.
Read the target, head, capability, requested action, authorization, event, and authorized pending-review value from ReviewContext.md.
Filter ReviewComments.md:
Ready for GitHub postingSkipped**Final**: markers, and PAW artifact names localResolve one candidate review ID:
Authorized Pending Review ID from ReviewContext.md.bind-created-review as a sentinel, not a concrete recovery ID.If both artifacts contain concrete IDs and they differ, block and report the mismatch. Do not create a duplicate.
Before any mutation, use GitHub read capabilities to resolve:
The repository and PR must match ReviewContext.md. A closed PR, missing target, or head mismatch blocks mutation.
If the head changed:
Preflight Status: blocked: head changed and the observed head in ReviewContext.md.If no candidate review ID is recorded:
Status: Posting in progress.Authorized Pending Review is bind-created-review, replace it in ReviewContext.md with the returned ID.If a candidate review ID is recorded:
Authorized Pending Review is bind-created-review, replace it with the re-resolved pending review ID before evaluating submission.For either path, compare the finalized comments with locally recorded and live pending-review comment IDs. Add only missing comments and record each returned comment ID before continuing.
Update ReviewComments.md after comment posting completes:
**Status**: Posted to GitHub pending review
**Pending Review ID**: <id>
**Comments Posted**: <posted> of <finalized>
Each posted comment records its GitHub comment ID. Skipped comments remain unposted in the artifact.
If Requested Output Action is pending, stop with the pending review.
For submit, require:
Submission Authorization: explicitImmediately before submission, re-read live GitHub state and verify this tuple:
repository + PR + live head + pending review ID + event
Every value must be present and equal to the authorization recorded in ReviewContext.md. On absence, ambiguity, mismatch, permission failure, or changed state:
When the tuple matches, submit that review with the authorized event. Record the submitted review ID, event, head, and timestamp in both artifacts.
A submitted review is terminal for this workflow run:
Treat each PR as a separate authorization boundary:
When the platform is Azure DevOps or local, or executable GitHub capability is unavailable:
An explicit unsupported submission request must have been reported before the Understanding stage. Do not silently convert it to artifact-only output.
True invariants
Defaults
User-configurable policy
Report one of:
基于 SOC 职业分类
