/openlore-review-changes

name: openlore-review-changes
description: Review code changes using OpenLore risk, call, coverage, and cluster evidence without editing code. Use when asked for a change review, pre-PR safety check, or merge recommendation.

openlore: Review Changes

When to use this skill

Trigger this skill whenever the user asks to **review, audit, or check the safety of recent changes**, with phrasings like:

• "review my changes"
• "what did I break?"
• "is this branch safe to merge?"
• "pre-PR check"
• "what's risky in this diff?"
• "check the blast radius of my changes"
• explicit command `/openlore-review-changes`

**No code is written.** Output is a risk-ranked review with a go/no-go recommendation.

---

Step 1 — Confirm directory and base ref

Ask: which project? Diff against which base? (default: `main`)

Store as `$DIRECTORY` and `$BASE_REF`.

---

Step 2 — Detect changed functions and risk scores

Call the openlore MCP tool `detect_changes` with:

{"directory": "$DIRECTORY", "base": "$BASE_REF"}

The risk score is **multiplicative**: `likelihood × impact`.

• `likelihood` = how much was changed × how poorly covered it is (`"called"` tests count full; `"imported"`-only count 0.3×)
• `impact` = structural blast radius (log fanIn + distance-weighted transitive callers weighted by callType + external boundary calls)

A function with fanIn=0 calling nothing external scores 0 regardless of change size — correct; focus on non-zero scores.

Present a risk-ranked table:

| Rank | Function | File | riskScore | blastRadius | fanIn | testedBy | |---|---|---|---|---|---|---|

Flag:

• `riskScore ≥ 5` → 🔴 HIGH — must inspect
• `riskScore 2–5` → 🟡 MEDIUM — inspect if time allows
• `riskScore < 2` → 🟢 LOW

---

Step 3 — Deep-inspect each HIGH function

For each function with `riskScore ≥ 5`, call `get_minimal_context`:

{"directory": "$DIRECTORY", "functionName": "$FUNCTION_NAME"}

**What to read:**

• `function.riskLevel` — `"high"` means the tool expanded caller/callee lists to 24. All shown entries are in the blast radius.
• `callers[*].callType` — all `"awaited"` = async interface frozen; any signature change breaks every caller without a compile error in JS. Mixed = looser coupling.
• `callees[*].isExternal: true` — function touches an external boundary (HTTP/DB). Failures here propagate outward and may not be caught in unit tests.
• `testedBy[*].confidence` — `"called"` = direct test (strong safety net). `"imported"` = test file only imports the module; `vi.mock()` can neutralize it entirely. Only `"imported"` = effectively untested.

For each HIGH function, state:

$FUNCTION_NAME ($FILE):
  Interface frozen? [yes — all callers await | no — mixed]
  External boundary? [yes: $CALLEES | no]
  Effective coverage: [strong (called) | weak (imported only) | none]
  Verdict: [safe | needs direct tests first | coordinate with callers before merge]

---

Step 4 — Check cluster density for non-safe HIGH functions

For any HIGH function whose verdict is not "safe":

{"directory": "$DIRECTORY", "functionName": "$FUNCTION_NAME"}
// get_cluster

Read `stats.clusterDensity`:

| Density | Meaning | Action | |---|---|---| | < 0.05 | Sparse — shared utilities | Change isolated; safe to land independently | | 0.05–0.15 | Moderate coupling | Review `internalCallGraph` for transitively dependent functions | | > 0.15 | Dense — tightly interwoven | Coordinate whole cluster; consider feature flag or staged rollout |

---

Step 5 — Coverage gap check

For each HIGH or MEDIUM function with `testedBy` empty or all `"imported"`:

> "⚠️ `$FUNCTION_NAME` has no direct test coverage. Changes here are not caught by the test suite unless a test directly calls this function. Recommend adding a characterisation test before merging."

Suggest a concrete test scenario based on the function body from `get_minimal_context`.

---

Step 6 — Output the review

Summary

• Total changed: N | HIGH: N | MEDIUM: N | Coverage gaps: N

Risk table

(from Step 2)

Function verdicts (HIGH only)

(from Steps 3–4)

Go / No-Go

• ✅ **Safe to merge** — no HIGH-risk uncovered functions
• ⚠️ **Merge with caution** — HIGH-risk functions exist but covered by direct tests
• 🛑 **Do not merge** — HIGH-risk uncovered functions with frozen interfaces or external boundaries

---

Absolute constraints

• Never skip Step 3 for HIGH-risk functions — riskScore alone is not enough
• Always interpret `callType` — determines whether interface change is breaking
• Always interpret `testedBy.confidence` — `"imported"` is not strong coverage
• Do not recommend merging any function with `riskScore ≥ 5`, zero direct tests, and an external callee