When Your Antigravity Agent Opens a PR That Just Says "Update files" — and a Gate That Forces a Reviewable Summary

Write the PR description in Markdown and fill in ALL of the headings below.
Each heading needs at least one sentence; if a heading does not apply,
write "Not applicable" together with the reason.
 
## What
The files changed and the gist of the change, as bullet points.
 
## Why
The problem this change solves. Include the related issue number if any.
 
## Risk
Where the impact is largest if this breaks. If the change touches any of
billing, authentication, data migration, or configuration values, you MUST
state that and describe the blast radius.
 
## Test
How correctness was confirmed. The tests added/changed and the boundary
conditions you checked.
 
## Review focus
One to three places you specifically want the reviewer to inspect.

#!/usr/bin/env node
// validate-pr-description.mjs
// Usage:
//   git diff --name-only origin/main...HEAD > /tmp/changed.txt
//   cat pr-body.md | node validate-pr-description.mjs --changed /tmp/changed.txt
 
import { readFileSync } from "node:fs";
 
// --- 1. Read inputs ------------------------------------------------
function readStdin() {
  try {
    return readFileSync(0, "utf8");
  } catch {
    return "";
  }
}
 
function getChangedFiles() {
  const idx = process.argv.indexOf("--changed");
  if (idx === -1) return [];
  const path = process.argv[idx + 1];
  return readFileSync(path, "utf8")
    .split("\n")
    .map((l) => l.trim())
    .filter(Boolean);
}
 
// --- 2. Required headings ------------------------------------------
const REQUIRED_SECTIONS = ["What", "Why", "Risk", "Test", "Review focus"];
 
// Phrases treated as "effectively empty." If this is all that is written, fail.
const VACUOUS = [
  /^update files?\.?$/i,
  /^fix(es|ed)? issues?\.?$/i,
  /^apply changes\.?$/i,
  /^n\/?a\.?$/i,
  /^none\.?$/i,
  /^not applicable\.?$/i, // bare "not applicable" with no reason is not enough
];
 
// --- 3. High-risk path patterns ------------------------------------
const HIGH_RISK = [
  { label: "billing", re: /(billing|payment|checkout|stripe|pricing|subscription)/i },
  { label: "auth", re: /(auth|login|session|token|oauth|credential)/i },
  { label: "migration", re: /(migration|migrate|schema|\.sql$)/i },
  { label: "config", re: /(config|\.env|settings|\.ya?ml$|\.toml$)/i },
];
 
// --- 4. Split the body by heading ----------------------------------
function parseSections(body) {
  const map = {};
  const re = /^##\s+(.+?)\s*$/gm;
  const heads = [...body.matchAll(re)];
  for (let i = 0; i < heads.length; i++) {
    const name = heads[i][1].trim();
    const start = heads[i].index + heads[i][0].length;
    const end = i + 1 < heads.length ? heads[i + 1].index : body.length;
    map[name.toLowerCase()] = body.slice(start, end).trim();
  }
  return map;
}
 
function isVacuous(text) {
  if (!text) return true;
  const firstLine = text.split("\n")[0].trim();
  return VACUOUS.some((re) => re.test(firstLine));
}
 
// A naive word-overlap measure to flag "Why is just a paraphrase of What"
function jaccard(a, b) {
  const norm = (s) =>
    new Set(
      s
        .toLowerCase()
        .replace(/[^\p{L}\p{N}\s]/gu, " ")
        .split(/\s+/)
        .filter((w) => w.length > 1)
    );
  const sa = norm(a);
  const sb = norm(b);
  if (sa.size === 0 || sb.size === 0) return 0;
  let inter = 0;
  for (const w of sa) if (sb.has(w)) inter++;
  return inter / (sa.size + sb.size - inter);
}
 
// --- 5. Validation -------------------------------------------------
function validate(body, changed) {
  const errors = [];
  const sections = parseSections(body);
 
  // 5-1. Required headings exist and are non-empty
  for (const name of REQUIRED_SECTIONS) {
    const text = sections[name.toLowerCase()];
    if (text === undefined) {
      errors.push(`Missing heading "## ${name}"`);
    } else if (isVacuous(text)) {
      errors.push(`"## ${name}" is effectively empty: "${text.split("\n")[0]}"`);
    }
  }
 
  // 5-2. Why must not be a paraphrase of What
  const what = sections["what"] ?? "";
  const why = sections["why"] ?? "";
  if (what && why && jaccard(what, why) > 0.8) {
    errors.push("Why is almost identical to What. Describe the motivation (why).");
  }
 
  // 5-3. If a high-risk path was touched, Risk must be non-empty.
  // We do not require the label name itself (to avoid over-detection);
  // we only guarantee Risk is non-empty.
  const hitLabels = new Set();
  for (const f of changed) {
    for (const { label, re } of HIGH_RISK) {
      if (re.test(f)) hitLabels.add(label);
    }
  }
  if (hitLabels.size > 0 && isVacuous(sections["risk"] ?? "")) {
    const labels = [...hitLabels].join(", ");
    errors.push(`Changed files related to ${labels}, but Risk is empty`);
  }
 
  return errors;
}
 
// --- 6. Run --------------------------------------------------------
const body = readStdin();
const changed = getChangedFiles();
 
if (!body.trim()) {
  console.error("PR description is empty. Fill in the template.");
  process.exit(1);
}
 
const errors = validate(body, changed);
if (errors.length > 0) {
  console.error("PR description does not meet the review requirements:\n");
  for (const e of errors) console.error("  - " + e);
  console.error("\nFill in every heading, and make Risk and Review focus concrete.");
  process.exit(1);
}
 
console.log("PR description meets the review requirements.");

// risk-score.mjs — a rough risk estimate from git diff numbers and paths
import { execSync } from "node:child_process";
 
const base = process.argv[2] ?? "origin/main";
const stat = execSync(`git diff --numstat ${base}...HEAD`, { encoding: "utf8" })
  .split("\n")
  .filter(Boolean)
  .map((l) => {
    const [add, del, file] = l.split("\t");
    return { add: Number(add) || 0, del: Number(del) || 0, file };
  });
 
const PATTERNS = [
  { label: "billing", re: /(billing|payment|checkout|stripe|pricing)/i, weight: 5 },
  { label: "auth", re: /(auth|session|token|credential)/i, weight: 4 },
  { label: "migration", re: /(migration|schema|\.sql$)/i, weight: 5 },
  { label: "config", re: /(config|\.env|\.ya?ml$|\.toml$)/i, weight: 3 },
];
 
let score = 0;
const reasons = [];
let totalDel = 0;
 
for (const { add, del, file } of stat) {
  totalDel += del;
  for (const { label, re, weight } of PATTERNS) {
    if (re.test(file)) {
      score += weight;
      reasons.push(`${label}: ${file} (+${add}/-${del})`);
    }
  }
}
 
// Large deletions add on their own (removing is easier to break than adding)
if (totalDel > 200) {
  score += 3;
  reasons.push(`large deletion: -${totalDel} lines total`);
}
 
const level = score >= 8 ? "HIGH" : score >= 4 ? "MEDIUM" : "LOW";
console.log(`Risk estimate: ${level} (score=${score})`);
for (const r of reasons) console.log("  - " + r);

#!/usr/bin/env bash
# open-pr.sh — open a PR only if it passes validation
set -euo pipefail
 
BASE="origin/main"
BODY_FILE="pr-body.md"   # the description the agent wrote
 
git diff --name-only "${BASE}...HEAD" > /tmp/changed.txt
 
# 1. Description gate (stop here if it fails)
if ! cat "${BODY_FILE}" | node validate-pr-description.mjs --changed /tmp/changed.txt; then
  echo "Description does not meet review requirements; not opening a PR. Have the agent rewrite it."
  exit 1
fi
 
# 2. Append the risk estimate to the description (a heads-up for humans)
{
  echo ""
  echo "---"
  echo "### Automated risk estimate"
  echo '```'
  node risk-score.mjs "${BASE}"
  echo '```'
} >> "${BODY_FILE}"
 
# 3. Only now open the PR
gh pr create --base main --title "$(git log -1 --pretty=%s)" --body-file "${BODY_FILE}"