Why

cubic writes most of the review comments on Infrahub PRs: 1,564 inline comments across 129 PRs between 2026-09-02 and 09-23. About 70% of them were accepted and fixed, which means most of that work could have happened before the PR opened. There was no way to run the same reviewer locally with Infrahub's own rules loaded, and our guidelines live in dev/guidelines/, which isn't one of the locations cubic auto-reads.

Goal: run cubic before pushing so PRs open with fewer threads to answer.

Non-goals: no pre-push hook (a review takes minutes), and no change to CI.

What changed

Review checklists in .cubic/ (frontend.md, backend.md, testing.md). They are distilled from dev/guidelines/ and .agents/rules/, and leave out anything Biome, ruff, mypy, betterer or knip already enforce. Each ends with a "Do NOT flag" section built from reviewer pushback that kept recurring (migration timestamps, transaction ownership, Cypher comments, React Compiler memoization). Each stays under cubic's 10,000-character limit per agent.
cubic.yaml attaches each checklist to PR reviews for its paths.
uv run invoke dev.cubic-review checks the CLI is installed and signed in, picks the base (the closer of stable and develop), then runs cubic with the checklists that match the changed paths.
reviewing-local-changes skill runs that task, checks every finding against the code, fixes the real ones with approval, and reviews again until clean. It also checks what the diff can't show and cubic often flags: specs that contradict the code, PR description and changelog claims, missing changelog fragments, and stale generated SDK and GraphQL files.
dev/guides/reviewing-with-cubic.md covers one-time setup and usage.

No product code, schema or API changes.

How to review

Start with cubic.yaml. Needs a cubic admin: cubic runs at most 5 custom agents per repo, and a repo cubic.yaml takes priority over dashboard settings. The docs don't say whether YAML agents replace dashboard agents (such as "Flag AI Slop and Fabricated Changes") or add to them. Please confirm before merging.
Then the .cubic/*.md checklists. Area owners, please check that the rules and the "Do NOT flag" items match how you review.
Then tasks/dev.py (cubic_review) and the skill.

How to test

bash .agents/skills/reviewing-local-changes/scripts/check-cubic.sh
uv run invoke dev.cubic-review

Verified: the preflight script fails with the right fix when the CLI isn't installed, when it's installed but not on PATH, when you aren't signed in, and outside a Git repo. The path-to-checklist mapping returns the expected checklists for sample paths. The task runs end to end. Ruff passes, mypy reports no new errors, and markdownlint and yamllint pass.

Not verified: I haven't seen a review return findings. The only run so far returned Subscription expired, because my account has no seat on the OpsMill cubic plan yet.

Impact & rollout

Config/env changes: cubic.yaml changes cubic's PR reviews for everyone once merged to stable, which is the only branch cubic reads config from.
Access: each person who runs a local review needs a seat on the OpsMill cubic subscription.

Checklist

Tests added/updated: not applicable, dev tooling only
Changelog entry added: not applicable, not user-facing
External docs updated: not applicable
Internal .md docs updated
I have reviewed AI generated content

Known follow-up: .agents/rules/testing-python.md allows freezegun, but dev/guidelines/backend/testing.md bans it and it isn't a dependency. .cubic/testing.md follows the guideline.

🤖 Generated with Claude Code