Repository navigation
[EMB-370] Bootstrap quad-agent development setup - #225
Open
Paul Kuiper (pkuiper-ultimaker) wants to merge 1 commit into
Open
Paul Kuiper (pkuiper-ultimaker) wants to merge 1 commit into
Paul Kuiper (pkuiper-ultimaker) wants to merge 1 commit into
Conversation
Copilot started reviewing on behalf of
Paul Kuiper (pkuiper-ultimaker)
October 6, 2026 06:37
View session
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Path deletion, credential isolation, protected-branch enforcement, and validation-hook defects must be corrected.
Review effort: Balanced
Findings: 3
Open (10)
What changed in this PR
Bootstraps Quad-Agent development guidance, safety hooks, validation tooling, and platform-specific configuration for um-kernel.
Changes:
- Adds repository guidance, rules, and agent definitions.
- Adds security, scope, branch, submodule, and file-size guards.
- Configures Claude, OpenCode, Copilot, pre-commit, and PR workflows.
| File | Description |
|---|---|
scripts/verify_and_create_pr.sh |
Adds pre-PR verification. |
scripts/sync_agentic_configs.sh |
Synchronizes agent configurations. |
scripts/get_github_token.sh |
Retrieves package credentials. |
scripts/create_boyscout_branch_and_pr.sh |
Extracts incidental changes. |
opencode.json |
Configures OpenCode exclusions. |
GEMINI.md |
Mirrors agent orientation. |
AGENTS.md |
Documents repository architecture. |
.talismanrc |
Configures secret scanning. |
.pre-commit-config.yaml |
Installs validation hooks. |
.ignore |
Provides generated AI exclusions. |
.gitignore |
Ignores hook byproducts. |
.github/hooks/copilot-hooks.json |
Configures Copilot hooks. |
.github/copilot-instructions.md |
Indexes Copilot rules. |
.github/copilot-content-exclusion.yml |
Documents Copilot exclusions. |
.gitattributes |
Registers Talisman merge handling. |
.claude/settings.json |
Configures Claude hooks and exclusions. |
.aiignore |
Defines AI content exclusions. |
.agents/rules/40-skill-discovery-index-rules.md |
Indexes optional skills. |
.agents/rules/35-device-tree-and-firmware-rules.md |
Adds hardware-specific guidance. |
.agents/rules/15-submodule-and-kernel-tree-rules.md |
Governs kernel submodule changes. |
.agents/rules/13-dependency-management-rules.md |
Defines dependency policy. |
.agents/rules/12-ai-context-exclusion-rules.md |
Defines AI exclusion policy. |
.agents/rules/10-file-size-and-decomposition-rules.md |
Establishes file-size limits. |
.agents/rules/09-atomic-bisect-safe-commits.md |
Defines commit hygiene. |
.agents/rules/08-scoped-changes-and-minimal-diffs.md |
Defines scope controls. |
.agents/rules/07-owasp-security-rules.md |
Adds security guidance. |
.agents/rules/06-pull-request-lifecycle-rules.md |
Defines PR workflow. |
.agents/rules/05-ultimaker-skill-discovery-rules.md |
Maps relevant skills. |
.agents/rules/04-build-test-and-deployment-rules.md |
Documents build and release flow. |
.agents/rules/02-security-and-paths.md |
Defines path and secret policy. |
.agents/rules/01-jira-commit-standards.md |
Defines Jira conventions. |
.agents/rules-manifest.json |
Records managed rule checksums. |
.agents/hooks/suggest-skills.py |
Suggests skills before edits. |
.agents/hooks/secret_scanner.py |
Detects committed secrets. |
.agents/hooks/rule_advisories.py |
Reports heuristic rule issues. |
.agents/hooks/pretool_guard.py |
Guards pending tool calls. |
.agents/hooks/post-edit-linter.sh |
Runs post-edit validation. |
.agents/hooks/path_scanner.py |
Detects local absolute paths. |
.agents/hooks/git-branch-guard.py |
Protects the base branch. |
.agents/hooks/file_size_scope.py |
Defines file-size scope. |
.agents/hooks/file_size_baseline.py |
Maintains size ceilings. |
.agents/hooks/copilot_index.py |
Synchronizes Copilot rules. |
.agents/hooks/compile_rule_frontmatter.py |
Validates rule metadata. |
.agents/hooks/check_upstream_alignment.py |
Reports base-branch drift. |
.agents/hooks/check_submodule_integrity.py |
Validates submodule tracking. |
.agents/hooks/check_multi_intent_scope.py |
Reports PR scope. |
.agents/hooks/check_atomic_bisect_history.py |
Checks history and builds. |
.agents/hooks/block-secrets.py |
Exposes secret scanning hook. |
.agents/hooks/block-absolute-paths.py |
Exposes path scanning hook. |
.agents/hooks/block_name_matched_kill.py |
Blocks broad process kills. |
.agents/hooks.json |
Configures Antigravity hooks. |
.agents/file-size-baseline.json |
Initializes size-ratchet state. |
.agents/dispatch-invariants.md |
Defines subagent constraints. |
.agents/bootstrap-observations.md |
Records bootstrap findings. |
.agents/aiignore-generated.json |
Tracks generated exclusions. |
.agents/agents/ecosystem_contract_investigator/agent.md |
Defines contract investigator. |
.agents/agents/architecture_investigator/agent.md |
Defines architecture investigator. |
.agents/agents/adversarial_pr_reviewer/agent.md |
Defines adversarial reviewer. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| from secret_scanner import SecretScanner # noqa: E402 | ||
| from path_scanner import PathScanner # noqa: E402 | ||
|
|
||
| FORBIDDEN_BRANCHES = ("main", "master", "staging") |
Comment on lines
+44
to
+52
| for path in "${PATHS[@]}"; do | ||
| if [ ! -e "$path" ]; then | ||
| echo "ERROR: '$path' does not exist." >&2 | ||
| exit 2 | ||
| fi | ||
| done | ||
|
|
||
| REPO_ROOT=$(git rev-parse --show-toplevel) | ||
| SAVE_DIR=$(mktemp -d) |
Comment on lines
+100
to
+103
| # Recompile AI exclusion targets from .aiignore (no platform reads it directly) | ||
| if [ -f .aiignore ] && [ -f .agents/hooks/compile_aiignore.py ]; then | ||
| python3 .agents/hooks/compile_aiignore.py || true | ||
| fi |
Comment on lines
+16
to
+17
| `CLAUDE.md`, `linting_excluded_files.txt`, | ||
| `scripts/sync_agentic_configs.sh`, `scripts/verify_and_create_pr.sh`. |
Comment on lines
+114
to
+117
| ls_tree = subprocess.check_output( | ||
| ["git", "ls-tree", "HEAD", submodule_path], text=True | ||
| ).strip() | ||
| if not ls_tree or "160000" not in ls_tree: |
Comment on lines
+139
to
+143
| if ownership == "managed" and manifest and path.name not in manifest: | ||
| errors.append( | ||
| f"{path.name}: hand-authored file in MANAGED band space " | ||
| f"({trigger} managed). It will be overwritten or deleted by the " | ||
| "next --update. Renumber to 15-19, 35-39 or 45-59.") |
Comment on lines
+94
to
+99
| if size > baseline["files"][name]: | ||
| baseline["files"][name] = size | ||
| raised.append((name, ceiling, size)) | ||
| for name, was, now in raised: | ||
| print(f"File-size ratchet: merge raises the ceiling for {name} " | ||
| f"({was} -> {now}); the incoming branch already gated that growth.") |
Comment on lines
+55
to
+57
| CHECKED_SUFFIXES: tuple[str, ...] = ( | ||
| '.py', | ||
| ) |
| if [ "$_pre_state" != "$_post_state" ]; then | ||
| # Which files the run itself touched, minus the ones this branch was | ||
| # already changing (a fixer tidying your own edit is legitimate). | ||
| _branch_files=$(git diff --name-only "$BASE_REF"...HEAD 2>/dev/null || true) |
Comment on lines
+26
to
+34
| ## Semantic Release & Version Tagging | ||
|
|
||
| 1. **SemVer Version Tagging**: | ||
| - Releases MUST follow Semantic Versioning (`MAJOR.MINOR.PATCH`). | ||
| - Tags MUST be created on main branch commits after PR integration. | ||
| 2. **Automated Changelog Generation**: | ||
| - Changelogs are generated directly from Pull Request titles. Ensure PR titles follow the `[EMB-370] <Descriptive Title>` standard. | ||
| 3. **Version Synchronization**: | ||
| - Keep the version number synchronized across the manifests this repository actually carries: DEBIAN `changelog` / `control`. A release that bumps one and not the others ships a lie about itself. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.