chore: add repository CodeRabbit policy

[esthor]

Summary

• add a self-contained .coderabbit.yaml for this public repository
• use assertive, continuous reviews for draft and ready pull requests
• hold CodeRabbit approval until all review comments and blocking pre-merge checks are resolved
• restrict CodeRabbit comment interactions to organization members
• keep learnings, issues, and pull-request context local to this repository
• disable Jira, Linear, MCP, and automatic cross-repository knowledge sources
• enable GitHub Issue enrichment and explicit agent-skill, workflow, and Actions security scanners
• enforce concise skill framing, progressive disclosure, deterministic scripts and tools, and cross-agent standards

Why

Repository review behavior should be public, versioned, and reviewable alongside the agent skills it governs. This policy deliberately disables inheritance and makes its important behavior and public-context boundaries explicit.

request_changes_workflow: true is the documented all-comments gate. Requested reviewers alone may override a failing pre-merge check, so a pull-request author cannot waive the checks on their own contribution.

The explicit tools cover the repository's main artifact types:

• SkillSpector checks agent skills and MCP configuration for malicious or risky patterns.
• actionlint validates GitHub Actions workflow syntax, expressions, and common mistakes.
• zizmor finds GitHub Actions security weaknesses such as dangerous triggers, permissions, and mutable dependencies.

Validation

• coderabbit config validate .coderabbit.yaml
• git diff --check
• coderabbit review --agent --uncommitted -c .coderabbit.yaml — zero issues

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The pull request adds a repository-level CodeRabbit policy with assertive review controls, automatic review settings, path-specific instructions, and related changelog updates.

Changes

CodeRabbit review policy

Layer / File(s)	Summary
Repository review policy configuration .coderabbit.yaml	Adds repository-wide review behavior, approval gating, automatic incremental reviews, selective finishing touches, and path-specific instructions for skills, commands, agents, manifests, and public documentation.
Changelog policy and distribution updates CHANGELOG.md	Adds an Unreleased entry for the CodeRabbit policy and consolidates archive-channel status information, including the v1.1.1 archive and documentation updates.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: juanpflores, nehal-a2z

Poem

A rabbit checks each policy line,
Reviews and changelog entries align.
Skills and manifests follow the flow,
Archive notes record the current status.
Hop, hop—clear checks now grow.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding a repository-level CodeRabbit policy.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch esthor/configure-coderabbit

---

_{Comment @coderabbitai help to get the list of available commands.}

[esthor]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.coderabbit.yaml:
- Line 23: Update the auto_pause_after_reviewed_commits setting from 0 to 1 so
reviews pause after one reviewed commit, and revise the Unreleased changelog
entry from “continuous incremental reviews” to describe this one-commit pause.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: b9bca74a-b31e-4cb0-9e38-b5ef044d0498

📥 Commits

Reviewing files that changed from the base of the PR and between bbb4ab2 and d5458bf.

📒 Files selected for processing (2)

• .coderabbit.yaml
• CHANGELOG.md

[esthor]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.coderabbit.yaml:
- Around line 10-12: Add a reviews.pre_merge_checks configuration alongside
request_changes_workflow, explicitly defining every required pre-merge check
with mode: error so failed checks block merging instead of remaining warnings.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: a5b89a82-11e1-4ba6-83ac-55e90b97b5db

📥 Commits

Reviewing files that changed from the base of the PR and between bbb4ab2 and 0d66bc6.

📒 Files selected for processing (2)

• .coderabbit.yaml
• CHANGELOG.md

[esthor]

@nehal-a2z @juanpflores — PR #26 is ready for repository-owner review on exact head 466771b1d2f7637aa61bd373b3fe904437f3af24.

CodeRabbit approved this exact head, all review threads are resolved, and the policy validates with zero errors against the current official schema. The final policy documents the one-reviewed-commit auto-pause, makes all four built-in pre-merge checks blocking errors, restricts overrides to requested reviewers, and clarifies the published v1.1.1 archive versus the channel’s current non-user-facing status.

The red Required approver / verify check is expected until either of you approves this latest head; one approval is sufficient.

[esthor]

needs some more changes