Skip to content
Back to skills

Review Decisions

ASecurity

Canonical decision policy for turning review findings into `review_backlog.json` decisions (`fix_now`, `verify_first`, `defer`, `drop`, `needs_human_decision`) with deterministic metadata and loop-cap behavior.

  • 37 stars
  • 0 votes
  • 0 copies
  • 3 views
  • Added May 28, 2026
testinggo

Security analysis

A100/100

Scanned May 28, 2026

npx -y skills add KjellKod/quest --skill review-decisions --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Review Decisions?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Review Decisions
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/kjellkod-review-decisions/badge)](https://www.skillsdirectory.com/skills/kjellkod-review-decisions)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: review-decisions
description: Canonical decision policy for turning review findings into `review_backlog.json` decisions (`fix_now`, `verify_first`, `defer`, `drop`, `needs_human_decision`) with deterministic metadata and loop-cap behavior.
---

# Review Decisions

Shared policy for Arbiter and PR shepherd style decision-making after review findings are normalized.

## When To Use

Use this skill when:
- Converting canonical review findings into backlog decisions
- Enforcing allowed decision taxonomy
- Applying loop-cap policy (governed by `gates.max_fix_iterations` in allowlist)
- Appending deferred findings to `.quest/backlog/deferred_findings.jsonl`

## Canonical Decision Set

Allowed `decision` values:
- `fix_now`
- `verify_first`
- `defer`
- `drop`
- `needs_human_decision`

Each backlog item must include:
- `decision_confidence`
- `reason`
- `needs_validation`
- `owner`
- `batch`

## Baseline Rules

1. Use `fix_now` for high-severity, high-confidence findings with clear evidence.
2. Use `verify_first` when confidence/evidence is weaker or reproduction is needed.
3. Use `defer` when scope/priority does not justify immediate work.
4. Use `drop` for low-value/noise findings after explicit evaluation.
5. Use `needs_human_decision` when risk/tradeoff needs explicit human call.

## Loop-Cap Rules

- Max fix iterations are governed by `gates.max_fix_iterations` in the allowlist (default 3).
- Solo mode uses `min(solo.max_fix_iterations, gates.max_fix_iterations)`.
- At cap, unresolved findings must be converted to:
  - `defer` (with accepted-debt rationale), or
  - `needs_human_decision`
- Do not silently continue looping after cap.

## Deferred Backlog Requirements

When a finding is deferred, append one JSON object per line to:
- `.quest/backlog/deferred_findings.jsonl`

Required lineage fields per deferred record:
- `deferred_by_quest`
- `deferred_at` (ISO8601 UTC)
- `defer_reason`
- `proposed_followup`

## Batching And Ownership

- `owner` should identify who can resolve the finding (usually by touched area).
- `batch` should group related files/findings to keep implementation slices focused.
- Prefer deterministic grouping by canonical write scope path.

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.