Merge pull request 'Fix #2334: wire native PR gate agent configs (pr-reviewer, pr-validator, pr-verifier)' (#2377) from task/2334-native-pr-gate-agents into main

Author: AlexMikhalev

scripts/adf-setup/agents/pr-reviewer.toml

@@ -1,10 +1,16 @@
 # PR-reviewer agent template
 #
-# Event-dispatched via DispatchTask::ReviewPr.
-# The orchestrator builds the bounded native PR gate prompt, owns Gitea
-# comment/status posting, and validates the final PrGateResult block.
+# Event-dispatched via the native PR gate path (DispatchTask::ReviewPr).
+# The orchestrator builds a bounded evidence prompt containing the PR diff,
+# changed files, linked issue, and Terraphim concept matches, then delivers
+# it to the agent via stdin. The agent produces a structural review report
+# and emits one canonical <!-- adf:gate-result {...} --> block.
 #
-# NO schedule field -- this is event-driven, not cron.
+# The orchestrator owns all Gitea comment/status posting and gate-result
+# parsing. This agent must NOT post comments, update statuses, or attempt
+# to read skills outside its working directory.
+#
+# NO schedule field -- event-driven, not cron.
 # Subscription-only models only (C1 constraint).
 
 [[agents]]
@@ -14,7 +20,6 @@ cli_tool = "/home/alex/.local/bin/claude"
 model = "sonnet"
 fallback_model = "kimi-for-coding/k2p5"
 persona = "Carthos"
-skill_chain = ["structural-pr-review"]
 max_cpu_seconds = 1800
 grace_period_secs = 30
-task = "Native structural PR gate producer. Review only the bounded evidence prompt provided by the orchestrator and emit one canonical adf:gate-result block. Do not post comments or statuses."
+task = "Native structural PR gate producer. Review only the bounded evidence prompt provided by the orchestrator and emit one canonical adf:gate-result block. Do not call tools, post comments, or update statuses."

scripts/adf-setup/agents/pr-validator.toml

@@ -0,0 +1,29 @@
+# PR-validator agent template
+#
+# Event-dispatched via the native PR gate path (DispatchTask::ReviewPr).
+# The orchestrator builds a bounded evidence prompt containing the PR diff,
+# changed files, linked issue, and acceptance criteria, then delivers it to
+# the agent via stdin. The agent validates the change against the linked
+# issue, acceptance criteria, user-visible behaviour, and release readiness,
+# then emits one canonical <!-- adf:gate-result {...} --> block.
+#
+# Gate context: adf/validation
+# Discipline: requirements validation
+#
+# The orchestrator owns all Gitea comment/status posting and gate-result
+# parsing. This agent must NOT post comments, update statuses, or attempt
+# to read skills outside its working directory.
+#
+# NO schedule field -- event-driven, not cron.
+# Subscription-only models only (C1 constraint).
+
+[[agents]]
+name = "pr-validator"
+layer = "Safety"
+cli_tool = "/home/alex/.local/bin/claude"
+model = "sonnet"
+fallback_model = "kimi-for-coding/k2p5"
+persona = "Carthos"
+max_cpu_seconds = 1800
+grace_period_secs = 30
+task = "Native requirements validation PR gate producer. Validate only the bounded evidence prompt provided by the orchestrator and emit one canonical adf:gate-result block. Do not call tools, post comments, or update statuses."

scripts/adf-setup/agents/pr-verifier.toml

@@ -0,0 +1,29 @@
+# PR-verifier agent template
+#
+# Event-dispatched via the native PR gate path (DispatchTask::ReviewPr).
+# The orchestrator builds a bounded evidence prompt containing the PR diff,
+# changed files, test evidence, and design intent, then delivers it to the
+# agent via stdin. The agent verifies the implementation evidence against
+# the design intent and test coverage, then emits one canonical
+# <!-- adf:gate-result {...} --> block.
+#
+# Gate context: adf/verification
+# Discipline: design and test verification
+#
+# The orchestrator owns all Gitea comment/status posting and gate-result
+# parsing. This agent must NOT post comments, update statuses, or attempt
+# to read skills outside its working directory.
+#
+# NO schedule field -- event-driven, not cron.
+# Subscription-only models only (C1 constraint).
+
+[[agents]]
+name = "pr-verifier"
+layer = "Safety"
+cli_tool = "/home/alex/.local/bin/claude"
+model = "sonnet"
+fallback_model = "kimi-for-coding/k2p5"
+persona = "Carthos"
+max_cpu_seconds = 1800
+grace_period_secs = 30
+task = "Native design and test verification PR gate producer. Verify only the bounded evidence prompt provided by the orchestrator and emit one canonical adf:gate-result block. Do not call tools, post comments, or update statuses."

scripts/adf-setup/tests/test_pr_gate_agents_template.py

@@ -0,0 +1,106 @@
+"""Tests for native PR gate agent templates (pr-reviewer, pr-validator, pr-verifier).
+
+Validates Step 5 of .docs/adf/2334/research-design.md:
+- TOML parses correctly
+- No skill_chain (bounded orchestrator prompt only)
+- No schedule (event-driven)
+- Task forbids tools, comments, and status posts
+- No producer-side shell or gtr usage
+"""
+
+from pathlib import Path
+
+try:
+    import tomllib
+except ImportError:
+    import tomli as tomllib  # type: ignore[no-redef]
+
+AGENTS_DIR = Path(__file__).parent.parent / "agents"
+
+GATE_TEMPLATES = {
+    "pr-reviewer": AGENTS_DIR / "pr-reviewer.toml",
+    "pr-validator": AGENTS_DIR / "pr-validator.toml",
+    "pr-verifier": AGENTS_DIR / "pr-verifier.toml",
+}
+
+FORBIDDEN_TASK_KEYWORDS = [
+    "gtr comment",
+    "curl -",
+    "source ~/.profile",
+    "git fetch",
+    "skill_chain",
+    "structural-pr-review",
+    "disciplined-validation",
+    "disciplined-verification",
+]
+
+REQUIRED_FIELDS = [
+    "name",
+    "layer",
+    "cli_tool",
+    "model",
+    "fallback_model",
+    "persona",
+    "max_cpu_seconds",
+    "grace_period_secs",
+    "task",
+]
+
+
+def _load_agent(path: Path) -> dict:
+    with open(path, "rb") as fh:
+        config = tomllib.load(fh)
+    assert "agents" in config and config["agents"], f"No agents in {path}"
+    return config["agents"][0]
+
+
+def test_templates_exist():
+    for name, path in GATE_TEMPLATES.items():
+        assert path.exists(), f"Missing template for {name}: {path}"
+
+
+def test_templates_parse():
+    for path in GATE_TEMPLATES.values():
+        _load_agent(path)
+
+
+def test_agent_names_match_files():
+    for expected_name, path in GATE_TEMPLATES.items():
+        agent = _load_agent(path)
+        assert agent["name"] == expected_name
+
+
+def test_required_fields_present():
+    for path in GATE_TEMPLATES.values():
+        agent = _load_agent(path)
+        for field in REQUIRED_FIELDS:
+            assert field in agent, f"{path.name} missing field: {field}"
+
+
+def test_no_skill_chain():
+    for path in GATE_TEMPLATES.values():
+        agent = _load_agent(path)
+        assert "skill_chain" not in agent, f"{path.name} must not define skill_chain"
+
+
+def test_no_schedule():
+    for path in GATE_TEMPLATES.values():
+        agent = _load_agent(path)
+        assert "schedule" not in agent, f"{path.name} must be event-driven (no schedule)"
+
+
+def test_task_contract():
+    for path in GATE_TEMPLATES.values():
+        agent = _load_agent(path)
+        task = agent["task"].lower()
+        assert "adf:gate-result" in task, f"{path.name} task must mention adf:gate-result"
+        assert "do not call tools" in task, f"{path.name} task must forbid tools"
+        assert "do not post comments" in task or "do not call tools, post comments" in task
+
+
+def test_no_producer_side_shell_or_gtr():
+    for path in GATE_TEMPLATES.values():
+        agent = _load_agent(path)
+        task = agent["task"]
+        for keyword in FORBIDDEN_TASK_KEYWORDS:
+            assert keyword not in task, f"{path.name} task must not contain: {keyword}"