Card review
Self-hosted AI coding factory — sandboxed agents deliver tickets to merged code, gated by a human in a dashboard. Local-first, cost-transparent, human-in-the-loop.
npx -y skills add tmj-90/gaffer --skill card-reviewAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Internal skill for onboard's semantic review gate. After the deterministic validation gate (which catches invented symbols / hash drift / secrets), this skill drives a sampled `claude -p` pass that checks whether the TLDR and role are DIRECTIONALLY ACCURATE given the file's structure and head snippet. The deterministic gate is the FLOOR; this skill is the ceiling check for plausible- but-wrong summaries (e.g. "handles auth middleware" when the file only renders auth *errors*). Used by onboard-analyze.mjs. Not for the ticket delivery flow.
SKILL.md
3.6 KB, 704 tokens by cl100k_base, as published. Nobody here has run it
Review one file card — the semantic accuracy gate
You will be given:
- A card (tldr + role) produced by the generation pass.
- The mechanical structure of the file (imports, top-level symbol names).
- A bounded head snippet of the file.
Your job: judge whether the TLDR and role are directionally accurate and not over-claiming — given ONLY the structure and snippet shown.
You are NOT asked to rewrite the card. You are asked to give a verdict and one sentence explaining it.
The accuracy bar
This is a generous but honest bar. You are not looking for perfection; you are catching meaningful errors.
A card PASSES if:
- The TLDR's primary claim is consistent with the structure and snippet.
- Imprecision or vagueness is acceptable as long as nothing is actively wrong.
- The role label is plausible (even if another label might be slightly better).
A card REVISES if:
- The TLDR is partially right but contains a specific false claim that could
mislead an agent (e.g. claims it exports
handleSessionwhen no such symbol appears in the structure). - The role label is clearly wrong (e.g.
migrationfor a route handler).
A card REJECTS if:
- The TLDR describes something fundamentally different from what the file is (e.g. "implements JWT authentication" for a file that only does arithmetic).
- The TLDR is so vague it provides zero retrieval value ("utility functions").
- The TLDR contains fabricated behaviour not visible in the structure or snippet.
What you must NOT do
- Do NOT penalise a card for being brief or imprecise — only for being wrong.
- Do NOT infer capabilities from the filename alone; use only what the structure and snippet show.
- Do NOT reject a card because you would have written it differently. The bar is directional accuracy, not editorial quality.
- Do NOT consider the symbols field in your verdict — that is the deterministic gate's job. Focus only on the TLDR and role_primary.
- Do NOT write a revised TLDR. Your output is verdict + one-sentence reason only.
Sampling context
This review runs on a SAMPLE of cards (typically up to 5 per onboard, configurable via GAFFER_CARD_REVIEW_SAMPLE). It is best-effort: a review failure never fails the onboard. Cards that pass the deterministic gate but fail this semantic gate are downgraded to model_status='failed_validation' with your reason recorded.
The mechanical fields (path, symbols, loc) are still served even for failed model summaries — the card retains retrieval value, just without the TLDR.
Output format
Return EXACTLY one fenced ```json block as the LAST thing in your response:
{
"verdict": "pass | revise | reject",
"reason": "<one sentence: what is correct, or what specific claim is wrong>"
}
Examples of good reasons:
- pass: "TLDR correctly identifies the file as arithmetic helpers exporting
addandPI." - revise: "TLDR claims
handleSessionis exported but that symbol is not in the structure." - reject: "TLDR describes JWT authentication but the file only contains math utility functions."
What ships with it
Read from the repository
Just SKILL.md. No reference files, no scripts.
Gives 0 of the 12 instructions most quality gates skills give in 704 tokens
Counted across 1,195 of the 2,094 authors here whose files we hold, read 2026-08-07
- Read the output and check the exit codein 54 of 1195, across 14 files
- Verify requirements using a line-by-line checklistin 53 of 1195, across 12 files
- Identify the verification command proving the claimin 51 of 1195, across 12 files
- Run the full verification commandin 50 of 1195, across 11 files
- Verify output confirms the claimin 49 of 1195, across 12 files
- Check version control diff after agent delegationin 46 of 1195, across 6 files
- State claim with evidencein 44 of 1195, across 4 files
- Run the test suitein 33 of 1195, across 26 files
- Keep state in memory by defaultin 27 of 1195, across 6 files
- Make prototype runnable with one commandin 26 of 1195, across 5 files
- Produce a verification reportin 25 of 1195, across 14 files
- Detect the package manager from lockfilesin 24 of 1195, across 5 files
Said here and by no other author read
- Judge whether the TLDR and role are directionally accurate
- Check that TLDR primary claim matches the structure and snippet
- Pass cards with plausible role labels
- Mark REVISE for TLDRs containing specific false claims
- Mark REVISE for clearly wrong role labels
- Mark REJECT for fundamentally different TLDR descriptions
Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.