[rig-tasks] Add 10 rig samples — 2026-07-25 - #111
Conversation
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
|
🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅ |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Skills-Based Review 🧠
Applied /grill-with-docs — requesting changes on two correctness issues and one missing pattern.
📋 Key Themes & Highlights
Issues Found
- 83 – output schema mismatch:
p.writeOutput("reportWritten", ...)writes a file but the top-level output iss.array(...)— noreportWrittenfield exists to capture the path. Needss.objectwrapper with areportWritten: s.stringfield (same pattern as samples 76, 81). - 87 – stash show bug:
git stash show --name-onlywithout a stash ref always readsstash@{0}, not each stash entry. A multi-stash inventory will return wrong files for every entry except the first. - 83 – empty
steering():steering()with no message injects no guidance. Pass a targeted{ message: "..." }as in sample 76. - 85 – mixed rule in defineTool: the
USER rootcheck OR-chains an unrelated--no-checkRUN pattern into the same finding, causing misleading messages.
Positive Highlights
- ✅ Excellent breadth of patterns covered (defineTool, repair, steering, subagent delegation, p.readOptional, p.writeOutput, s.record, s.enum)
- ✅ All 10 samples pass typecheck
- ✅ Consistent use of
|| true/|| echo '...'for safe bash fallbacks - ✅ Good
// Agent role:comments throughout
🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · sonnet46 47.2 AIC · ⌖ 4.54 AIC · ⊞ 6.3K
Comment /matt to run again
| const commitFormatSuggester = agent({ | ||
| model: "small", | ||
| instructions: p`Review recent git commits: ${p.bash("git log --oneline -20 --no-merges")}. For each commit, check whether its message follows conventional commit format (type: description). Suggest a rewritten message in conventional format. Classify each commit as one of: feat, fix, chore, docs, test, refactor, style. Write the full report to commit-report.md via ${p.writeOutput("reportWritten", "commit-report.md")}.`, | ||
| output: s.array(s.object({ |
There was a problem hiding this comment.
[/grill-with-docs] p.writeOutput("reportWritten", ...) declares a write intent but the output schema is s.array(s.object(...)) — there is no reportWritten field in the schema to capture the written path. The harness needs a corresponding string field in the output schema.
💡 Fix
Wrap in s.object and add the reportWritten field, matching the pattern from samples 76 and 81:
output: s.object({
commits: s.array(s.object({
hash: s.string,
original: s.string,
suggested: s.string,
category: s.enum("feat", "fix", "chore", "docs", "test", "refactor", "style"),
})),
reportWritten: s.string,
}),| // Agent role: inventory all git stashes with their descriptions, changed files, and staleness classification. | ||
| const gitStashInventory = agent({ | ||
| model: "small", | ||
| instructions: p`List all git stashes: ${p.bash("git stash list 2>/dev/null || echo 'No stashes found'")}. For each stash entry shown, show its changed files: ${p.bash("git stash show --name-only 2>/dev/null || true")}. For each stash, classify its staleness as: fresh (< 1 week), aging (1-4 weeks), stale (1-3 months), ancient (> 3 months) based on the date shown in the stash list.`, |
There was a problem hiding this comment.
[/grill-with-docs] git stash show --name-only without a stash reference always shows stash@{0} — only the top stash's files are fetched, not each individual stash entry. For an inventory of N stashes, this produces wrong data for all but the first.
💡 Fix
The agent needs to iterate over stash refs. Use a command that iterates, or note in the instructions that the agent should call git stash show --name-only stash@{N} per entry. A bash one-liner like this collects all at once:
git stash list --format='%gd' | xargs -I{} sh -c 'echo "---{}"; git stash show --name-only {} 2>/dev/null'Or simplify to a single p.bash that already includes the stash ref loop.
| category: s.enum("feat", "fix", "chore", "docs", "test", "refactor", "style"), | ||
| })), | ||
| maxTurns: 5, | ||
| addons: [steering(), repair()], |
There was a problem hiding this comment.
[/grill-with-docs] steering() is called with no message, which means no guidance text is injected on the final retry. The reference docs state: "Use steering({ message: '...' }); a positional string is invalid." An empty steering() is technically valid but wastes the final-turn hint.
💡 Suggestion
Add a targeted steering message, as in sample 76:
addons: [steering({ message: "Follow conventional commit format strictly: type(scope): imperative description." }), repair()],|
|
||
| const checkSecurityPattern = defineTool("checkSecurityPattern", { | ||
| description: "Check a Dockerfile line for known security anti-patterns", | ||
| parameters: s.object({ line: s.string, lineNumber: s.number }), |
There was a problem hiding this comment.
[/grill-with-docs] The USER root check regex uses ||' pattern — /^USER\s+root\s*$/i.test(line.trim()) || /^RUN.&&.&&.*--no-check/.test(line) — the second part (--no-check) is bundled into the same 'running as root' finding. This mixes two unrelated anti-patterns into one rule, making the message "Running as root user"misleading when theRUN --no-check` branch triggers.
💡 Fix
Split into separate findings:
if (/^USER\s+root\s*$/i.test(line.trim())) {
findings.push({ severity: "critical", message: "Running as root user", rule: "no-root-user" });
}
if (/^RUN.*--no-check/.test(line)) {
findings.push({ severity: "high", message: "Package install skips integrity check", rule: "no-skip-check" });
}1 participant
Summary
Added 10 new rig sample files to
skills/rig/samples/.Typecheck failures
None — all 10 tasks passed typecheck.
Tasks run