runner-review

name: runner-review
description: >
  Review Python runner code for convention violations. Use after modifying files
  under components/runners/ambient-runner/. Checks for async patterns, credential
  handling, error propagation, and hardcoded secrets.
tools:
  - Read
  - Grep
  - Glob
  - Bash

Runner Review Agent

Review runner Python code against documented conventions.

Context

No runner-specific DEVELOPMENT.md exists yet. Review against general Python best practices and the patterns visible in `components/runners/ambient-runner/src/`.

Checks

R1: Proper async patterns (Major)

No blocking calls (`open()`, `requests.`, `time.sleep()`) inside async functions. Use `aiofiles`, `httpx`, `asyncio.sleep()`.

R2: Credential handling (Blocker)

No hardcoded credential values. Credentials loaded from environment or K8s secrets. No credentials in log statements.

R3: Error propagation from subprocess (Critical)

Subprocess calls must propagate errors, not swallow them. Return codes checked, errors raised or logged with context.

R4: No hardcoded secrets or API keys (Blocker)

grep -rn "sk-\|api_key=\|password=" components/runners/ambient-runner/ --include="*.py" | grep -v "_test\|test_\|example\|mock"

Output Format

# Runner Review

## Summary
[1-2 sentence overview]

## Findings

### Blocker
[Must fix — or "None"]

### Critical
[Should fix — or "None"]

### Major
[Important — or "None"]

### Minor
[Nice-to-have — or "None"]

## Score
[X/4 checks passed]

Each finding includes: file:line, problem description, convention violated, suggested fix.