feat: skills - add auto-tmux report review checklist

skills/auto-tmux/scripts/AGENTS.md

@@ -25,6 +25,7 @@ scripts/
 ├── remote-readonly.sh # SSH 只读采集远端 tmux 证据
 ├── record-summary.sh # 汇总 pipe-pane 录制日志
 ├── check-jsonl.sh # 轻量 JSONL 字段门禁
+├── review-checklist.sh # report pack reviewer 审计清单
 ├── completion.bash # Bash completion
 ├── safety-check.sh # 发送/粘贴/分发前的 payload 安全预检
 ├── render-swarm-prompt.sh # commander/worker/reviewer 提示词渲染
@@ -57,6 +58,7 @@ scripts/
 - 远端脚本只能运行 tmux list/capture 等只读命令，不允许 send-keys、kill 或配置写入。
 - 录制摘要脚本只读 record 日志，输出默认脱敏，不修改日志源文件。
 - JSONL 检查脚本只能做轻量字段门禁，不替代完整 JSON parser。
+- 审计清单脚本只读报告包目录，不修改报告源文件。
 - completion 文件只能定义 shell completion，不执行 tmux 写操作。
 - 安全预检脚本只能读取文本或文件，不控制 tmux，不写状态目录。
 - 状态脚本只能写入显式状态目录，不保存密钥、Token、密码或私密项目内容。

skills/auto-tmux/scripts/README.md

@@ -22,6 +22,7 @@
 - [`remote-readonly.sh`](./remote-readonly.sh) - 通过 SSH 只读采集远端 tmux 拓扑、pane 输出和 `metadata.jsonl`。
 - [`record-summary.sh`](./record-summary.sh) - 汇总 `record start` 产生的 pane 日志，生成复盘摘要。
 - [`check-jsonl.sh`](./check-jsonl.sh) - 轻量检查 JSONL 行和必需字段。
+- [`review-checklist.sh`](./review-checklist.sh) - 为 report pack 生成 reviewer 审计清单。
 - [`completion.bash`](./completion.bash) - Bash completion，补全 `auto-tmux.sh` 和 `swarm-state.sh` 子命令。
 - [`safety-check.sh`](./safety-check.sh) - 发送、粘贴或分发前检查危险命令、敏感信息和过大 payload。
 - [`render-swarm-prompt.sh`](./render-swarm-prompt.sh) - commander、worker、reviewer 提示词渲染。
@@ -112,6 +113,9 @@ skills/auto-tmux/scripts/record-summary.sh --dir /tmp/auto-tmux-records --out /t
 # 检查 JSONL 字段
 skills/auto-tmux/scripts/check-jsonl.sh /tmp/ai-swarm-results.jsonl --require-key type --require-key id --require-key status
 
+# 生成 report pack 审计清单
+skills/auto-tmux/scripts/review-checklist.sh --pack /tmp/ai-swarm-report-pack --out /tmp/ai-swarm-report-pack/review-checklist.md
+
 # 启用当前 shell 的补全
 source skills/auto-tmux/scripts/completion.bash
 

skills/auto-tmux/scripts/auto-tmux.sh

@@ -153,7 +153,7 @@ cmd_doctor() {
     status_line "WARN" "tmux server has no reachable session yet"
   fi
 
-  for script in auto-tmux.sh swarm-state.sh swarm-brief.sh swarm-watch.sh swarm-archive.sh swarm-board.sh swarm-deps-graph.sh swarm-export.sh swarm-timeline.sh swarm-blockers.sh swarm-results.sh swarm-report-pack.sh swarm-assign.sh swarm-health.sh remote-readonly.sh record-summary.sh check-jsonl.sh safety-check.sh render-swarm-prompt.sh swarm-dispatch.sh auto-tmux-smoke-test.sh validate-auto-tmux.sh; do
+  for script in auto-tmux.sh swarm-state.sh swarm-brief.sh swarm-watch.sh swarm-archive.sh swarm-board.sh swarm-deps-graph.sh swarm-export.sh swarm-timeline.sh swarm-blockers.sh swarm-results.sh swarm-report-pack.sh swarm-assign.sh swarm-health.sh remote-readonly.sh record-summary.sh check-jsonl.sh review-checklist.sh safety-check.sh render-swarm-prompt.sh swarm-dispatch.sh auto-tmux-smoke-test.sh validate-auto-tmux.sh; do
     if [[ -x "$script_dir/$script" ]]; then
       status_line "OK" "script executable: $script"
     else

skills/auto-tmux/scripts/review-checklist.sh

@@ -0,0 +1,91 @@
+#!/usr/bin/env bash
+# review-checklist: render a reviewer checklist for an auto-tmux report pack.
+set -euo pipefail
+
+usage() {
+  cat <<'EOF'
+review-checklist: render a reviewer checklist for an auto-tmux report pack
+
+Usage:
+  review-checklist.sh --pack DIR [--out FILE]
+
+Defaults:
+  --out stdout
+
+This script is read-only for the report pack. It writes only when --out is set.
+EOF
+}
+
+die() {
+  printf 'error: %s\n' "$*" >&2
+  exit 1
+}
+
+pack_dir=""
+out_file=""
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --pack)
+      pack_dir="${2:-}"
+      shift 2
+      ;;
+    --out)
+      out_file="${2:-}"
+      shift 2
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      die "unknown option: $1"
+      ;;
+  esac
+done
+
+[[ -n "$pack_dir" ]] || die "missing --pack"
+[[ -d "$pack_dir" ]] || die "pack dir not found: $pack_dir"
+
+exists_mark() {
+  local path="$1"
+  if [[ -e "$pack_dir/$path" ]]; then
+    printf 'x'
+  else
+    printf ' '
+  fi
+}
+
+render_checklist() {
+  printf '# auto-tmux Report Review Checklist\n\n'
+  printf -- '- pack_dir: `%s`\n' "$pack_dir"
+  printf -- '- created_at: `%s`\n\n' "$(date -Is)"
+
+  printf '## Required Files\n\n'
+  local file
+  for file in index.md manifest.json board.md deps.md timeline.md blockers.md results.md results.jsonl assign.md export/manifest.json; do
+    printf -- '- [%s] `%s`\n' "$(exists_mark "$file")" "$file"
+  done
+
+  printf '\n## Review Gates\n\n'
+  printf -- '- [ ] `manifest.json` type is `auto-tmux-swarm-report-pack`.\n'
+  printf -- '- [ ] `results.md` clearly lists DONE/FAIL/BLOCKED worker outcomes.\n'
+  printf -- '- [ ] `blockers.md` has no unresolved blocker that prevents handoff.\n'
+  printf -- '- [ ] `assign.md` does not imply an unclaimed task was silently executed.\n'
+  printf -- '- [ ] Attachments, if present, are explicit evidence directories and do not contain secrets.\n'
+  printf -- '- [ ] Reviewer can reproduce the key conclusion from files in this pack only.\n'
+
+  printf '\n## Suggested Commands\n\n'
+  printf '```bash\n'
+  printf 'skills/auto-tmux/scripts/check-jsonl.sh %q --require-key type --require-key id --require-key status\n' "$pack_dir/results.jsonl"
+  printf 'grep -F "\"type\": \"auto-tmux-swarm-report-pack\"" %q\n' "$pack_dir/manifest.json"
+  printf '```\n'
+}
+
+if [[ -n "$out_file" ]]; then
+  mkdir -p "$(dirname "$out_file")"
+  render_checklist > "$out_file"
+  printf 'review checklist written: %s\n' "$out_file"
+else
+  render_checklist
+fi

skills/auto-tmux/scripts/swarm-report-pack.sh

@@ -146,6 +146,7 @@ cat > "$out_dir/manifest.json" <<EOF
     "results.md",
     "results.jsonl",
     "assign.md",
+    "review-checklist.md",
     "export/manifest.json"
   ],
   "attachments": [
@@ -170,11 +171,14 @@ cat > "$out_dir/index.md" <<EOF
 - [results.md](./results.md)
 - [results.jsonl](./results.jsonl)
 - [assign.md](./assign.md)
+- [review-checklist.md](./review-checklist.md)
 - [manifest.json](./manifest.json)
 - [export/manifest.json](./export/manifest.json)
 $(if [[ -n "$attachment_lines" ]]; then printf '%s' "- [attachments.md](./attachments.md)"; fi)
 EOF
 
+run_report "review checklist" "$script_dir/review-checklist.sh" --pack "$out_dir" --out "$out_dir/review-checklist.md"
+
 rm -f /tmp/auto-tmux-report-pack.log
 if [[ "$make_tar" == "1" ]]; then
   command -v tar >/dev/null 2>&1 || die "tar not found"

skills/auto-tmux/scripts/validate-auto-tmux.sh

@@ -115,6 +115,7 @@ scripts=(
   "$script_dir/remote-readonly.sh"
   "$script_dir/record-summary.sh"
   "$script_dir/check-jsonl.sh"
+  "$script_dir/review-checklist.sh"
   "$script_dir/safety-check.sh"
   "$script_dir/render-swarm-prompt.sh"
   "$script_dir/swarm-dispatch.sh"
@@ -162,6 +163,7 @@ run_gate "swarm-report-pack attachment" bash -c '
   grep -Fq "attachments.md" "$tmp/out/index.md"
   grep -Fq "results.md" "$tmp/out/index.md"
   grep -Fq "results.jsonl" "$tmp/out/index.md"
+  grep -Fq "review-checklist.md" "$tmp/out/index.md"
   grep -Fq "manifest.json" "$tmp/out/index.md"
   grep -Fq "\"type\": \"auto-tmux-swarm-report-pack\"" "$tmp/out/manifest.json"
   grep -Fq "\"attachments\"" "$tmp/out/manifest.json"
@@ -183,6 +185,7 @@ run_gate "check-jsonl required keys" bash -c '
   "$1" "$tmp" --require-key type --require-key id --require-key status >/dev/null
   rm -f "$tmp"
 ' _ "$script_dir/check-jsonl.sh"
+run_gate "review-checklist help" "$script_dir/review-checklist.sh" --help
 run_gate "safety-check help" "$script_dir/safety-check.sh" --help
 run_gate "safety-check clean text" "$script_dir/safety-check.sh" --text "make test"
 if "$script_dir/safety-check.sh" --text "rm -rf /tmp/example" >/tmp/auto-tmux-validate-gate.log 2>&1; then
@@ -209,6 +212,7 @@ require_contains "$skill_dir/SKILL.md" "scripts/swarm-health.sh"
 require_contains "$skill_dir/SKILL.md" "scripts/remote-readonly.sh"
 require_contains "$skill_dir/SKILL.md" "scripts/record-summary.sh"
 require_contains "$skill_dir/SKILL.md" "scripts/check-jsonl.sh"
+require_contains "$skill_dir/SKILL.md" "scripts/review-checklist.sh"
 require_contains "$skill_dir/SKILL.md" "scripts/completion.bash"
 require_contains "$skill_dir/SKILL.md" "scripts/safety-check.sh"
 require_contains "$skill_dir/SKILL.md" "scripts/swarm-dispatch.sh"
@@ -242,6 +246,7 @@ require_contains "$script_dir/README.md" "remote-readonly.sh"
 require_contains "$script_dir/README.md" "metadata.jsonl"
 require_contains "$script_dir/README.md" "record-summary.sh"
 require_contains "$script_dir/README.md" "check-jsonl.sh"
+require_contains "$script_dir/README.md" "review-checklist.sh"
 require_contains "$script_dir/README.md" "completion.bash"
 require_contains "$script_dir/README.md" "safety-check.sh"
 require_contains "$script_dir/AGENTS.md" "validate-auto-tmux.sh"
@@ -260,6 +265,7 @@ require_contains "$script_dir/AGENTS.md" "swarm-health.sh"
 require_contains "$script_dir/AGENTS.md" "remote-readonly.sh"
 require_contains "$script_dir/AGENTS.md" "record-summary.sh"
 require_contains "$script_dir/AGENTS.md" "check-jsonl.sh"
+require_contains "$script_dir/AGENTS.md" "review-checklist.sh"
 require_contains "$script_dir/AGENTS.md" "completion.bash"
 require_contains "$script_dir/AGENTS.md" "safety-check.sh"