Pr Triage

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass.

Audit 0.4.1 · source sha 0448e87653f9 · 14 Oct 2026Report an issue or request a re-scan

• Publisheraaronjmars GitHub organizationOwner of the repository this skill is read from
• Source folderaaronjmars/aeon/skills/pr-triageThe exact folder we audited
• LicenceMITAs the repository states it
• Commit pinned for this verdict0448e87653f9A new audit runs when the source changes
• Repository statusNot archivedPushed today
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: First-touch triage for external pull requests - verdict, label, and a welcoming comment within minutes of open

---
name: pr-triage
description: First-touch triage for external pull requests - verdict, label, and a welcoming comment within minutes of open
metadata:
  title: PR Triage
  category: dev
  var: ""
  tags:
    - dev
---
> **${var}** — PR scope. Accepts `owner/repo`, `owner/repo#N`, or empty (all watched repos). If empty, scans every repo in `memory/watched-repos.md`.

External PRs that sit unanswered look unwelcoming. This skill is the **first touch** for every external pull request — it reads the diff, applies a structured rubric, posts a comment with a verdict + rationale, and labels the PR so a human reviewer can pick it up with full context. It is not a substitute for `pr-review` (depth) or `auto-merge` (execution); it is the welcoming layer that runs before either of those decide whether to engage.

## What "external" means

Any PR whose author is **not** in the trusted set qualifies. The trusted set is, by precedence:

1. Logins ending in `[bot]` (`dependabot[bot]`, `renovate[bot]`, `github-actions[bot]`, ...) — these route to `auto-merge` / `pr-review`.
2. The agent's own login: `aeonframework`, `aeonfun`, and any login under a `## Trusted Authors` heading in `memory/watched-repos.md` (same allowlist convention used by `auto-merge`).

Everything else is **external** and gets triaged.

## Config

`memory/watched-repos.md`:

```markdown
# Watched Repos
- aeonfun/aeon
- aaronjmars/aeon-agent

## Trusted Authors
- alice
- bob
```

If the file is missing and `${var}` is empty, log `PR_TRIAGE_OK no-watched-repos` and exit.

---

Read `memory/MEMORY.md` for context.
Read `memory/triaged-prs.json` (if present; else treat as `{}`) — schema: `{"owner/repo": [{"n": 143, "sha": "abc123", "at": "2026-04-29", "verdict": "ACCEPTED"}, ...]}`. Used for idempotency keyed on (PR number, headRefOid).
Read the last 2 days of `memory/logs/` as a fallback dedup signal in case the JSON state file is missing.

## Steps

### 1. Resolve targets

- `${var}` matches `^[\w.-]+/[\w.-]+#\d+$` → single-PR mode: target that exact PR.
- `${var}` matches `^[\w.-]+/[\w.-]+$` → repo mode: scan all open PRs on that one repo.
- `${var}` is set but matches neither shape → abort with `pr-triage: invalid var — expected owner/repo or owner/repo#N` and exit.
- `${var}` is empty → fleet mode: read non-comment, non-blank `- ` lines from `memory/watched-repos.md` (everything **above** the `## Trusted Authors` heading).

### 2. Fetch candidate PRs

For each repo:

```bash
gh pr list -R owner/repo --state open --limit 25 \
  --json number,title,body,author,isDraft,labels,headRefOid,baseRefName,additions,deletions,files,createdAt,updatedAt,isCrossRepository \
  --search "created:>=$(date -u -d '14 days ago' +%Y-%m-%d)"
```

Per-run budget: **≤8 PRs per repo per run** (newest first; remainder logged as overflow).

In single-PR mode, fetch just the one PR:
```bash
gh pr view N -R owner/repo \
  --json number,title,body,author,isDraft,labels,headRefOid,baseRefName,additions,deletions,files,createdAt,updatedAt,isCrossRepository
```

### 3. Skip rules (record reason for each skip)

Skip a PR if any of the following hold:

- `isDraft: true` — drafts are work-in-progress
- title matches `^(WIP|\[WIP\]|Draft:)` (case-insensitive)
- has any of the labels `no-triage`, `do-not-merge`, `wip`, `blocked`, `triage:accepted`, `triage:needs-changes`, `triage:deferred`, `triage:out-of-scope` (already triaged)
- author is in the trusted set (see "What 'external' means")
- this PR's `(number, headRefOid)` already appears in `memory/triaged-prs.json["owner/repo"]` (already triaged at this commit; new pushes re-triage)
- the PR already has a comment whose body starts with `**Triage:**` and was posted within the last 7 days (defensive layer in case state file is wiped). Check via:
  ```bash
  gh api repos/owner/repo/issues/NUMBER/comments --jq '.[] | select(.body | startswith("**Triage:**")) | .created_at'
  ```

If every PR was skipped across all targets, log `PR_TRIAGE_OK no-candidates` and exit (no notification).

### 4. Fetch the diff per remaining PR

```bash
gh pr diff NUMBER -R owner/repo
```

If `additions + deletions > 3000`, do not read the full diff — read only the top-5 largest-delta files via:
```bash
gh api repos/owner/repo/pulls/NUMBER/files --jq 'sort_by(-(.additions + .deletions)) | .[0:5] | .[] | {path: .filename, patch}'
```

If `gh pr diff` fails entirely (e.g. mid-rebase) and the file API also returns empty, skip with reason `empty-diff` (do not block on transient API state).

### 5. Apply the rubric → verdict

Score the PR against four checks. Every check is observable from the diff + metadata, no guesswork.

| Check | Pass condition |
|---|---|
| **Scope** | Touches only `skills/`, `docs/`, `output/`, `catalog/`, `README.md`. Touching `.github/workflows/`, `aeon` (root binary), `aeon.yml`, `CLAUDE.md`, `AGENTS.md`, `eyebrow.policy.json`, `harness-adapter/`, `bin/`, `scripts/`, `apps/mcp-server/`, `apps/dashboard/lib/` requires a maintainer. |
| **Format** | If a `skills/<name>/SKILL.md` is added or modified, the file has YAML frontmatter with `name`, `description`, `var`, `tags` keys. (Skip this check when no SKILL.md is touched.) |
| **Originality** | If a new skill is added, its directory name does not already exist on `main`. Cross-check via `gh api repos/owner/repo/contents/skills` once per run. |
| **Size** | `additions + deletions ≤ 500` lines, OR labelled `large-ok` by a maintainer. |

Verdict assignment (first match wins, in this order):

- **OUT-OF-SCOPE** — Scope check fails AND the touched paths are protected (`.github/workflows/`, `aeon`, `aeon.yml`, `CLAUDE.md`, `AGENTS.md`, `eyebrow.policy.json`, `harness-adapter/`, `scripts/skill_mode.sh`, `scripts/secretcurl.sh`). External contributors cannot ship workflow / runtime changes; redirect them to file an issue.
- **NEEDS-CHANGES** — Format check fails (SKILL.md missing required frontmatter), OR Originality check fails (skill name collides), OR PR body is empty AND addi

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

git clone https://github.com/aaronjmars/aeon
git -C aeon checkout 0448e87653f9

Works in

1. 2026-10-14
   ✓SAFE B 89 / 100

   first audit · source 0448e87653f9

Questions about Pr Triage

• github.com/aaronjmars/aeon/tree/main/skills/pr-triage — the audited source at commit 0448e87653f9 and every finding aboveObserved · 14 Oct 2026

Spotted something wrong? Report a correction · Methodology