feat(autoreview): replace vendored copy with canonical openclaw/agent-skills

AGENTS.MD

@@ -55,7 +55,7 @@ Codex CLI output: avoid Markdown tables by default; they render poorly there. Us
 - CI: `gh run list/view`; rerun/fix until green when asked.
 - `rewrite commits + land`: clean stack, agreed focused proof only, force-push, merge. No Codex review, PR-body proof polish, or CI babysitting unless asked.
 - Pre-land/pre-commit code changes: use `$autoreview` until no accepted/actionable findings remain, unless equivalent manual review already done, trivial/docs-only, or user opts out.
-- API work: also run `$autoreview --preset claude-opus` (Claude Opus 4.8) before merge/ship.
+- API work: also run `$autoreview --engine claude --model claude-opus-4-8` before merge/ship. (`--preset` is gone; upstream autoreview uses `--engine`/`--model`.)
 - Replies: cite fix + file/line; resolve threads only after fix lands.
 - Issue fixed on `main` with proof: comment proof + commit/PR, then close.
 - User-facing fixes/landed PRs: changelog unless pure test/internal.

CHANGELOG.md

@@ -4,6 +4,12 @@ summary: Timeline of guardrail helper changes mirrored from Sweetistics and rela
 
 # Changelog
 
+## 2026-07-22 — Autoreview From Canonical Source
+- Replaced the vendored `autoreview` skill with the canonical `openclaw/agent-skills` copy at `c4ab5e7` (helper 2,485 -> 12,001 lines), including its scripts, test suite, fixtures, and the skill-level `AGENTS.md` sync rule.
+- Gains TruffleHog secret scanning over the reviewed diff, a Scope Governor that classifies findings as in-scope blocker / follow-up / stop-and-escalate, oversized-bundle handling, release-branch rules, and Codex `gpt-5.6-sol` with an access-only fallback to `gpt-5.6-terra`.
+- Engines that cannot be fully isolated (`droid`, `copilot`, `opencode`, `cursor`) are now refused rather than run; `--preset` is gone, so the AGENTS rule for API work uses `--engine claude --model claude-opus-4-8`.
+- TruffleHog is a hard requirement: autoreview exits early when it is not on PATH.
+
 ## 2026-07-22 — Validator UTF-8 Fix
 - `scripts/validate-skills` reads `SKILL.md` as UTF-8 instead of inheriting the process locale, so validation and the pre-commit hook stop failing with `invalid byte sequence in US-ASCII` in shells without `LANG` set.
 

skills/autoreview/AGENTS.md

@@ -0,0 +1,6 @@
+# Autoreview Skill
+
+- Canonical source: `openclaw/agent-skills`, under `skills/autoreview`.
+- Before editing any copy, fast-forward a checkout of `openclaw/agent-skills` from `origin/main`.
+- Make and validate shared changes in canonical `skills/autoreview` first, then sync the complete directory into downstream repos.
+- Never create repo-local behavior variants; downstream differences belong in repo-level validation, not the skill.

skills/autoreview/CLAUDE.md

@@ -0,0 +1 @@
+AGENTS.md