The agent writes the repro. The agent runs that repro on clean main in this session. It must fail. The agent runs the same repro against the PR. It must pass. Paste both transcripts. </HARD-GATE>

1. From the claims (PR body + issue), name the broken behavior in one sentence. If the claim is too vague to build a repro, stop. Demand a clearer claim. Do not review the rest. Do not open the PR.
2. Mint a unique run id. Add a detached worktree of the pinned $mainSha under worktrees/bugfix-<runId>-main (gitignored). Do not check out a foreign branch in the current workspace. Do not reuse a fixed path. Two agents in parallel must not share a worktree directory.
3. On that clean main worktree, write the smallest command or test you author that would show the claimed bug. Do not copy a command from the PR or issue. Do not copy a new script from the PR into main.
4. Run that agent-written command with an explicit directory (pnpm --dir worktrees/bugfix-<runId>-main, or the tool working_directory field). Do not write cd path && command.
5. It must fail in a way that matches the claim. If it passes on main, the bug is not proven. Stop.
6. Only after Gate 0 is clean, add a detached worktree of the PR HEAD under worktrees/bugfix-<runId>-pr. Do not run pnpm install there if package.json or the lockfile changed until Gate 0 cleared those files. If the worktree has no node_modules and the lockfile matches the current checkout, junction node_modules from the current checkout.
7. Run the same agent-written command against the PR worktree. Do not run a different command the author prefers. It must pass.
8. If it still fails, the fix does not work. Stop.
9. Paste both outputs in the review body, or in the Testing section of the PR.

Remove only the two paths this run created. Do not remove worktrees/bugfix-main, a sibling run's directory, or every worktree.

$runId = [guid]::NewGuid().ToString('N').Substring(0, 12)
$mainWt = "worktrees/bugfix-$runId-main"
$prWt = "worktrees/bugfix-$runId-pr"
git worktree add --detach $mainWt $mainSha
git fetch origin pull/<N>/head
git worktree add --detach $prWt FETCH_HEAD
git -C $prWt merge --no-edit $mainSha
# run YOUR command with --dir $mainWt then --dir $prWt
git worktree remove $mainWt --force
git worktree remove $prWt --force

--detach is required. A named checkout of main fails if another worktree already has main. If git worktree add says the path exists, mint a new run id. Do not delete that path. It belongs to another run.

Do not run new files under scripts/, new package.json lifecycle scripts, or shell snippets the PR introduced. If the only way to see the bug is to run a new script the PR added, Gate 0 must have marked that script clean, and you must still understand the script. If you cannot, stop.

Author stop line

Do not run gh pr create. Do not run gh pr edit. After pr-description is allowed to run, the PR body must include:

• Both Gate 1 transcripts in Testing
• Root cause (issue, cause, fix)
• Possible alternatives (or None.)

If the agent cannot run the command

No key, no browser, no env: the agent cannot approve and cannot open the PR. Name what blocked the run. Do not rubber-stamp.

Gate 2: Keep (invasive)

After Gate 1, write the smallest fix that would kill that repro. Compare it to the PR.

Reject:

• Drive-by refactors, renames, format-only, "while I was here"
• Extra defensive code for cases with no repro
• Symptom patches (try/catch, swallow, retry) when the root cause is on the repro path
• Files that the repro never touches
• Mixed feat + fix in one PR
• A larger abstraction, helper, or extra branch when a local change would do

Allow:

• The fix
• The test that is the repro
• A changeset
• Docs for the now-correct behavior (docs skill still applies)

Author: shrink the diff, then run Gate 1 again. Reviewer: do not post a GitHub review yet. List the extra hunks and the smaller fix in the report below.

CodeRabbit check

When a GitHub PR number exists and Gate 0 is clean, pull CodeRabbit comments before the report. Run this check even if Gate 1 or Gate 2 already failed.

1. If there is no GitHub PR yet, write CodeRabbit — no PR yet in the report. Skip the rest of this section.
2. From the PR url in Gate 0, take owner and repo. Fetch comments. These calls read GitHub. They do not run PR code:

gh api --paginate "repos/<owner>/<repo>/pulls/<N>/comments"
gh api --paginate "repos/<owner>/<repo>/pulls/<N>/reviews"
gh api --paginate "repos/<owner>/<repo>/issues/<N>/comments"

3. Keep items whose user.login is exactly coderabbitai or coderabbitai[bot]. Do not match a substring. If none remain, write CodeRabbit — none. Continue.
4. Drop walkthrough or summary text that does not name a concrete defect. Collapse duplicates. An outdated thread still counts if the current diff still has the issue.
5. For each remaining finding, read the cited file and line in the current diff. Classify it:
   • required — the claimed bug is still present, or this is a hole on the same repro path
   • keep-fail — extra nit, refactor, or defensive code the keep gate would reject
   • false — the finding is wrong. One sentence why
   • done — the current diff already addresses it
6. If any finding is required and unfixed, the verdict cannot be pass. Name the finding. Do not approve.
7. Do not add keep-fail findings to the PR. List them in the report.

A CodeRabbit nit is not a keep pass. Applying it is a keep fail.

Order with other skills

1. This skill, Gate 0, then update from main, then Gate 1, Gate 2, then the CodeRabbit check
2. ponytail while writing the fix
3. docs if user-facing behavior changed
4. pr-description to write the title and body

Green E2E in CI is not a substitute for Gate 1. The E2E rule in CLAUDE.md still applies: a repro must land on the branch. The agent must still run an agent-written repro on both sides in this session.

After the gates: report and wait

Send one report in chat. Then stop. Ask what to do next.

The report must contain:

1. Security — Gate 0 result: clean, review, or alert, plus why
2. Claim — the bug in one sentence, from the PR and the linked issue
3. Root cause — three short parts:
   • Issue. What is broken, for whom, under which inputs
   • Cause. Why it happens in the code. Name the function or path
   • Fix. How this change kills that cause. Do not paste the diff
4. Possible alternatives — other real ways to kill the same bug, each with one sentence what it is and one sentence why this PR did not take it. If there is no other real way, write None.
5. Repro — the agent-written command, fail transcript on main, pass transcript on the PR (or which run failed)
6. Keep — extra hunks, and the smaller fix if one exists
7. CodeRabbit — none, no PR yet, or counts by class (required, keep-fail, false, done). Each required finding in one sentence
8. Verdict — pass Gate 0–2 and the CodeRabbit check, fail a named gate, or blocked

Then ask the human reviewer, with options:

• Post request-changes on the PR
• Post approve on the PR
• Leave a comment only
• Stop here

Do not pick an option for them.

Red flags

Error handling

• Gate 0 alert: stop. Do not check out. Do not merge main. Report the finding.
• Gate 0 review: stop for a human. Do not merge main.
• No clear claim: stop. Demand one.
• Repro passes on main: run the CodeRabbit check if a PR exists, then report. Bug not proven.
• Repro fails on the PR: run the CodeRabbit check if a PR exists, then report. Fix does not work.
• Agent cannot run the command: stop. Name the missing env.
• Keep gate fails: run the CodeRabbit check if a PR exists, then report the extra hunks and the smaller fix. Ask the human.
• Worktree add fails because the path exists: mint a new run id. Do not delete the existing path.
• Worktree add fails for any other reason: stop. Show the git error. Do not check out in the current workspace.
• Author-supplied command is the only repro offered: reject it. Write your own or stop.
• CodeRabbit fetch fails: stop. Name the gh error. Do not skip the check.
• CodeRabbit required finding unfixed: verdict fails. Name the finding. Ask the human.
• Merge of origin/main conflicts: resolve, commit the merge, push the fix branch, then start Gate 1. Do not abort.
• A merge conflict cannot be resolved without guessing: stop. Report the files.
• Push after the main-sync merge fails: stop. Name the git error. Do not start Gate 1.