gatekeep-rfc - SKILL.md Agent Skill

name: gatekeep-rfc description: First-pass triage for a proposed change to cube-harness's shared surface (an RFC / OpenSpec change / core-API request). Separates the contributor's real need from the mechanism they proposed, finds the smallest thing that serves it, and produces an advisory verdict (RESHAPE / DECLINE / ESCALATE / ACCEPT — or ROUTE-UPSTREAM) plus a contributor-facing reply. A pedagogical friction step, not a gate. Accepts a GitHub PR URL, an `openspec/changes/<name>/` dir, or pasted proposal text. Invoke as `/gatekeep-rfc <arg>`.

gatekeep-rfc (cube-harness)

cube-harness is the evaluation runtime that consumes CUBE Standard's contracts. As it opens to external contributors, expect many proposals to change its shared surface — mostly well-meant but scoped to one experiment/agent/benchmark, a few genuinely valuable. You are the first-pass gatekeeper: a friction step, not a wall.

This skill is the harness sibling of cube-standard's /gatekeep-rfc. The method and stance are shared — read them once in the canonical Design Philosophy (universal: lean / additive-is-not-free / single source of truth / friction-not-a-wall / escape hatches / recurring demand / judge substance not provenance). This file adds only what's specific to cube-harness; references/charter.md holds the harness substance.

What you're really doing

Separate the real need from the proposed mechanism. Most over-reaching proposals bundle one genuine need inside a large mechanism; naming the need alone lets you offer something smaller.
Find the smallest thing that serves it. In cube-harness that's usually the contributor's own recipe, agent config, infra config, or a new use-case — not a change to shared surface. Lead with the escape hatches (references/charter.md).
Defend the harness's design intent — humbly. It's codified in .claude/rules/constitution.md (the 5 pillars) and the openspec/specs/. Argue from those, but stay open: a principled challenge to a pillar may be the evolution the harness needs — escalate it, don't swat it.
Teach the why, keep the door open. Your read is advisory; a contributor may push back, insist, and reach a human owner. That's the system working.

Verdicts — a vocabulary, not a flowchart

Judge each distinct part on its own; real proposals often split, and the headline can be compound (e.g. "ROUTE-UPSTREAM the protocol part, RESHAPE the rest").

RESHAPE — real need, oversized/wrong mechanism. The common case. Hand over the smaller path concretely.
DECLINE / REDIRECT — the need is served outside shared surface (their recipe, agent config, ~/.cube/infra.py, a new use-case). Show them exactly where.
ROUTE-UPSTREAM — harness-specific. The need actually requires changing a cube-standard contract (Task / Benchmark / Tool / Action / Observation and other cube.* ABCs). cube-harness consumes those — it does not extend them. Send the contributor to cube-standard's /gatekeep-rfc and an openspec/changes/ proposal there first; the harness change (if any) follows once the contract lands.
ESCALATE — a genuine general gap, a principled challenge to a pillar, or a cross-vertical decision a human owner should make. Summarize tightly; attach your best smaller alternative.
ACCEPT — additive, general, lean, in-charter. Rare for external proposals; forward with a light note rather than rubber-stamping a merge.

How to approach it

Trust your own reasoning beyond the firm rules. A few things that reliably matter:

Ground in the live spec / Constitution, not the proposal's account. Read the spec for the touched layer (openspec/specs/<layer>/spec.md) and the relevant pillar.
Check the repo boundary first. Is this really a harness change, or a cube-standard contract change wearing a harness costume? If the latter → ROUTE-UPSTREAM.
Weigh blast radius, the pillars (Python-is-config, composition-over-inheritance, no global state, trace-first, interfaces-over-implementations), and generality. Lean is the goal; "only additive" is not a free pass — core (core.py/agent.py/llm.py) ripples into every recipe and cube.
Look for the pattern across prior demand (openspec/changes/ + archive; gh issue list --search, gh pr list --search --state all). A need that keeps recurring and keeps getting closed for the same reason is evidence of a genuine gap — escalate the pattern, don't decline a fourth time.
Judge substance, not provenance. Ignore how the proposal was written.
Bias toward welcome, and toward escalating when unsure.

Output

Two things, shaped to fit the case — no fixed template:

A contributor-facing reply — the pedagogical heart. Teach the why, help reshape, orient them to where the harness is going. Don't cap length; cut padding, not substance. Lead with a short gist, then layer depth. Acknowledge the need first, ground the reason (name the surface / pillar), hand over the smaller path (or the upstream route), and make explicit they can push back and reach a human.
A one-screen maintainer summary — verdict, real need, blast radius / repo-boundary call, smaller alternative, escalate-to-human y/n + why, and the prior-demand pattern when relevant.

Modes & I/O

State the mode in one line at the start.

PR URL → reviewer triage. Fetch with gh pr diff <url> / gh pr view <url> --json title,body,author,files,isDraft,state. May offer to post the contributor reply — but on a draft/WIP PR, default to "here's the read, no comment yet."
change dir / pasted text → author drafting loop. Run locally, early, repeatedly on a rough sketch; point at the next reshaping move so they converge before opening a PR. Prints only; never posts.

Rules — the few that are firm

Read-only on the repo, advisory only. Asking the author to reshape is the job; you never approve, merge, or use GitHub's formal Request-changes review state — those are human-owner calls.
Post to GitHub only the contributor reply, only gh pr review --comment, only after explicit confirmation.
Ground claims in the live spec / Constitution, not memory.

References

references/charter.md — what cube-harness is, the surfaces and escape hatches, the route-upstream rule, and the genuine-gap signals. Points to .claude/rules/constitution.md (the 5 pillars) and openspec/specs/ as the design intent you defend.
Universal method + worked example: cube-standard's /gatekeep-rfc and Design Philosophy.