Service Diffguard

Service Diffguard reviews a diff with six focused lenses. Each lens runs as a read-only Amp Task subagent, inspects the requested change, and returns findings graded on one shared scale. Lenses advise only — they never edit, stage, or commit code, never disable tests, and never bypass a failing check to make it pass.

Default scope is the unstaged git diff unless the caller names specific files, a branch, a commit range, or an existing PR.

Gate scale

Every finding carries a Gate. The run's overall Gate is the highest any lens returns.

Every G2 or higher finding must include: file:line, Proof (evidence from the diff), why it matters, a Patch direction (smallest safe fix), and how to verify. Weak or speculative observations go under Open checks, not as a finding. Cap G1 items at five per lens unless exhaustive polish is requested.

Lens catalog

Languages in this repo

Diffguard reviews a changed file in whatever language it is written in. Each lens applies its concept (correctness, failure visibility, comment truth, test coverage, contract design, simplification) through the idioms of that language — Go is the primary codebase, not the only one.

Repo-local authority

All lenses treat AGENTS.md (and any nested AGENTS.md) as authoritative.

Apply these repo skills only to .go files, where relevant:

• use-modern-go — Go implementation style.
• layered-architecture-types — App ↔ Business ↔ Storage: primitives at the edges, strong types in Business, named converters only.
• business-layer-extensions — the ExtBusiness / Extension decorator seam.
• branching-logic-flow — defaulting and shallow control flow.

validate-pr-title applies whenever the PR title is in scope, regardless of language.

Diff intake

1. Resolve scope from the caller.
2. With no explicit scope, inspect unstaged changes:
   • git status --short
   • git diff --name-only
   • git diff
   • For a branch/PR: git diff --name-only <base>...HEAD, or gh pr diff.
3. Build a short change inventory: which languages/areas changed (see Languages in this repo); production vs test files; App/Business/Storage files; comments or doc strings; error/failure handling; new or modified types, interfaces, converters, component contracts, proto messages, or SQL schema; PR title if a PR is in scope.

Lens routing

Route by what changed unless the caller asks for "full", "all", or "PR-ready".

• Always (any production code changed, any language): Service Steward.
• Production code or tests changed, or coverage asked: Harness Map.
• Diff touches any failure path — Go err/errors.Is/As/wrapping/defer/ recover/context, JS try/catch/promises/await/fetch, SQL transactions, Rego allow/deny logic, or shell exit codes; plus logging and fallback/default behavior: Error Tripwire.
• Any contract or shape changed — Go structs/interfaces/constructors/ converters/Business strong types/DB rows/stores, Vue props/emits, proto messages, or SQL schema: Boundary Keeper.
• Comments, doc strings (Go doc, JSDoc), examples, README snippets, or TODO/FIXME changed: Doc Drift Check.
• Polish pass: Straight-Line Pass — run in a second wave after G4/G3 findings are resolved, or in the first wave only when simplification is explicitly requested.

Execution

Run lenses as Task subagents. Because they are read-only, parallel is safe and preferred for a broad PR sweep; prefer sequential when scope is ambiguous, the diff is very large, or only one concern was requested.

Default is a two-wave plan:

• Wave 1 (risk): Service Steward, Harness Map, plus Error Tripwire, Boundary Keeper, and Doc Drift Check where applicable.
• Wave 2 (polish, optional): Straight-Line Pass, after high-risk findings are addressed or when requested.

Launch each lens with a prompt of this shape:

Use `.agents/skills/review-pr/reference/<lens>.md` as your review instructions.

Scope: <exact scope>
Diff source: <unstaged git diff | PR diff | branch range | file list>
Languages in scope: <e.g. Go; Vue/JS; Rego; proto; SQL; Helm/YAML; shell>
Repo context: polyglot monorepo (Go primary). Follow AGENTS.md; apply Go skills to .go files only.
Mode: advisory/read-only — do not modify files.

Return a Gate report only, using the G0-G4 scale.

Aggregation

Merge lens reports into one Diffguard report. Deduplicate overlapping findings by failure mode and location; on disagreement keep the higher Gate.

# Service Diffguard Report

Scope: <scope reviewed>
Overall Gate: G[0-4] — <Clear/Polish/Tighten/Repair/Stop>

## Run matrix
| Lens               | Result        | Notes |
|--------------------|---------------|-------|
| Service Steward    | Gx            | ...   |
| Error Tripwire     | Gx / skipped  | ...   |
| Doc Drift Check    | Gx / skipped  | ...   |
| Harness Map        | Gx / skipped  | ...   |
| Boundary Keeper    | Gx / skipped  | ...   |
| Straight-Line Pass | Gx / deferred | ...   |

## Fix queue
### G4 Stop
- [lens] <title> — `file.go:line`
  - Proof:
  - Patch direction:
  - Verify:
### G3 Repair
### G2 Tighten
### G1 Polish

## Clear signals
- <What looks solid and why.>

## Open checks
- <Anything not reviewed, unavailable, or needing human confirmation.>

## Suggested verification
- Go: `make test-only`, or `go test ./path/...` for a single package.
- Frontend: the project's JS test/lint/build scripts in `api/frontends/admin`.
- SQL/Rego/proto: the relevant migration, policy, or codegen check for that area.
- Re-run affected lenses after fixes.