[potiuk]

Summary

• The code-review skill now gives adversarial reviewers an export of the PR's head as --repo-dir, instead of an empty directory. With an empty directory they see only the diff, title and body, and reply without findings.
• The export leaves out .apache-magpie-overrides/tools/vetted-ops. The secure setup denies writes to that path wherever it appears, so a full git archive | tar -x stops partway through. The deny rule stays as it is.
• The skill now says the exported tree reaches the reviewers' model providers, in both the "what leaves the machine" note and the session announcement.

Type of change

• Skill change (.claude/skills/<name>/) — eval fixtures updated below
• Tool / bridge contract (tools/<system>/*.md)
• Python package (tools/*/ with pyproject.toml)
• Groovy reference impl
• Cross-cutting (RFC, AGENTS.md, sandbox, privacy-LLM)
• Documentation (docs/, README.md, CONTRIBUTING.md)
• Project template (projects/_template/)
• CI / dev loop (prek, workflows, validators)
• Other:

Test plan

• Commit hooks pass on the two changed files, and prek run --files with workspace-pytest skipped reports no failures. prek run --all-files was not run.
• Eval suite for pr-management-code-review — not run. No fixtures changed.
• Other: ran the documented git archive export against a real PR head under the sandbox. tar exited 0 and the policy path is absent.

Notes for reviewers

• The exclusion also applies when a PR changes the policy file, so the skill tells the reviewer to read that file themselves.
• git archive honours export-ignore, so those paths are missing from the export too. The skill says so.
• More now leaves the machine than before: the whole head tree rather than the diff alone. The existing "ask first on a private <upstream>" rule covers this.

Gen-AI disclosure

Drafted with Claude Code (Claude Opus 5), and reviewed by the maintainer opening this PR.

🤖 Generated with Claude Code