---

name: coderabbit description: Process CodeRabbit AI PR review suggestions from CODERABBIT.md in the TCC repo; triage, validate against code/specs, and implement safe, production-ready fixes.

CodeRabbit

Process CodeRabbit suggestions when CODERABBIT.md has new review comments. Validate before fixing; line numbers drift.

Workflow

1) Build issue index

Read CODERABBIT.md and create a tracking table:

2) Validate using snippets (not line numbers)

Search for the exact pattern referenced in the comment:

Copyrg "<snippet>" apps api db

Verify:

• Pattern exists in the current code
• Issue not already fixed
• No ADR or spec explicitly mandates the pattern

3) Decision sweep before fixes

Check decisions before touching core systems (auth, RLS, telemetry, evidence, audit):

• docs/ADRs/
• ENGINEERING_SPEC.md
• IMPLEMENTATION_PLAN.md

4) Skip rules

Always skip:

• Comments about .md files (docs-only)
• Suggestions that conflict with ADRs/specs
• Style/formatting preferences
• Test-only issues unless they affect reliability

5) Production guardrails

• RLS: use app.tenant_id from auth context; never trust tenant_id from request body
• Auth: respect Keycloak/JWT or X-API-Key flows; never weaken authz checks
• Audit: preserve audit_events_hash_chain_trg behavior; don't bypass audit logging
• Evidence packs: never mutate evidence after creation; preserve signed manifests
• Telemetry: never store call content, transcripts, or PHI

Related skills

code-simplifier

After fixes, use code-simplifier if:

• Fixes introduced duplication
• Control flow became deeply nested
• Multiple similar patterns could share a helper

Common false positives

• "Missing null check" - may be guaranteed by types or upstream validation
• "Hardcoded value" - may be required by spec or ADR
• "No error handling" - may be handled by outer middleware
• "RLS missing" - check if RLS is enforced at the transaction/session layer

Output format

1. Quick status table (ID, Severity, Status, File, Action)
2. Summary: Total | Fixed | Skipped | Deferred
3. Files changed list
4. Verification commands run (typecheck/lint/build)
5. Fixed issues with details
6. Skipped issues with reasons
7. Deferred issues needing user input