[potiuk]

Summary

• Replaces "an empty temporary directory" as --repo-dir with a tested export of the PR's head, in the shared pre-PR block and security-issue-import-from-pr.
• adversarial-review run now warns when --repo-dir is empty, and its refusal text no longer recommends an empty directory.
• Fixes a pointer defect from perf(security-issue-sync): load stage-specific rules only when they apply #1997: the hand-off rules were not read when a gate blocked the label.
• Closes a title gap from perf(security-issue-sync): load stage-specific rules only when they apply #1997: in Foo 2.1.0 now fails the title gate.

What is and is not claimed about the empty directory. #1986 recorded that reviewers given an empty --repo-dir reply without findings. That did not reproduce here, on PR #1997 with the configured reviewers:

--repo-dir	Findings	Reviewers that ran
Empty	2	codex, copilot
Exported PR head	1	codex, copilot

antigravity hit a quota error in both runs. One PR neither proves nor disproves #1986, so the wording claims only what is certain: reviewers cannot read the surrounding code, so no findings is not a clean review.

The pointer defect. The same runs flagged signals-to-actions.md:546. With a shipped release and a record still DRAFT, the label cannot flip, so the pass never proposes the transition, and with no marker comment the agent never read the fill-fields rule. The new case-9 failed on the merged pointer and passes 3/3 after the trigger became state-based: any open tracker labelled pr merged or fix released, even when a gate blocks the next label.

Type of change

• Skill change (.claude/skills/<name>/) — eval fixtures updated below
• Python package (tools/*/ with pyproject.toml)

Test plan

• prek run --all-files --skip workspace-pytest passes, including lychee
• workspace-pytest passes for the changed files
• Validator exits 0; no surface_hash changed
• New tests failed before the fixes and pass now (adversarial-review warning, title gate)
• pointer-routing 10/10, case-9 3/3, step-2b-proposed-changes 12/12
• The six suites that include the block: 19/19 before and after
• The export recipe ran against a real PR, with the protected path excluded

RFC-AI-0004 compliance

• Vendor neutrality — placeholders kept; the check-placeholders hook passes
• Privacy LLM — the block says to export only a PR that is already public; the exported tree reaches the reviewers' providers

Linked issues

Follows #1986, #1997.

Notes for reviewers

• A behaviour change, on purpose. Any open pr merged or fix released tracker now loads about 3.3k more tokens, even if it needs nothing. Correctness was chosen over that saving.
• security-cve-allocate changes too. The title fix is in the shared strip().
• The earlier test was green and still incomplete. perf(security-issue-sync): load stage-specific rules only when they apply #1997's pointer passed against a copy with the pointers deleted; that check only covers triggers someone thought of.
• The recipe assumes a GitHub-hosted PR. pull/<number>/head is GitHub's ref layout.
• Evals predate the last rebase. They ran before rebasing onto feat(optimize-skill): prove pointers and estimate what a run reads #2000 and docs(spec-loop): sync specs with main up to 6cd53e0d9 #2001; prek and workspace-pytest ran after it.
• Single model. No cross-model eval pass.

🤖 Generated with Claude Code