[goanpeca]

Summary: adopt the AI-native SDLC playbook in b2-sdk-python, with agent and review guidance built from this repo's own review history and the standard repository policy files.

Motivation

Closes #634.

More PRs here are written with coding agents, and the rules reviewers apply live only in past threads. A review of the last 80 PRs (#514 to #633) found the same problems over and over. Changelog fragments were missing, and tests did not fail when the fix was reverted. Uploads were retried in the HTTP layer, apiver exports were missing, and raw_simulator.py drifted from raw_api.py. PRs were also duplicated or split across several branches. 27 of 61 merged PRs had no review from anyone but the author.

Changes

• Playbook: AGENTS.md covers the codebase map, local CI commands, conventions and 13 recurring review findings with their PR numbers. CLAUDE.md points to it. docs/review-lessons.md groups the same lessons by theme. REVIEW.md sets out the passes (Bugs, Wire, Security, Compatibility across apiver layers, Compliance) with Important / Nit / Pre-existing severities, file:line evidence and convergence rules. intent/README.md has the intent/spec/plan templates.
• .claude/: the playbook skills (ai-native-sdlc routes between them) and a PostToolUse hook that runs ruff format --check and ruff check on every Python file Claude edits. It exits 2 with a fix message and skips if neither ruff nor uvx is available.
• Changelog: towncrier and the existing CI check stay as they are. The fragment rules and the -changelog label are now documented in CONTRIBUTING and AGENTS.
• Repo policies: RELEASE.md replaces the one-line README.release.md and is based on make_release_commit, cd.yml and the 2.13.x release commits. Also added: SECURITY.md, CODE_OF_CONDUCT.md, issue forms (bug, feature, task) with a private security link, a PR template with Risk and How to revert sections, .editorconfig, and .gitignore entries for .DS_Store and .claude/settings.local.json. CONTRIBUTING gains Before you start, Coding agents and Local CI sections.
• intent/review-process/intent.md: a draft proposal for the maintainers covering risk tiers by path, re-approval after new commits, required conversation resolution, automated AI and security review, release commits through a PR, a green baseline (Credentialed encryption integration expects SSE-B2 but live account returns NONE #614, and nox -s lint running ruff format in write mode), reviewer evals built from past bugs, and metrics.

No library code changes.

Testing

All run locally on Python 3.14 (macOS arm64):

• nox -s lint: success. It reformats noxfile.py in place, which is a pre-existing problem noted in the intent; that change was reverted and is not part of this PR.
• nox -s towncrier_check: success.
• nox -s unit-3.14: success. v3 893 passed, v2 900 passed, v1 975 passed, v0 816 passed. cover also passed.
• nox -s build: success.
• nox -s doc and doc_cover: success, with graphviz and plantuml from a conda env.
• codespell on the new files: clean. The only hit is the existing "Re-using" in CONTRIBUTING's nox output example.
• ruff hook: exits 0 on a formatted file, exits 2 with a message on an unformatted one, and exits 0 on non-Python files.

Integration tests were not run (no live-B2 credentials used).

Risk

None for library users; only docs, templates and Claude config change. The PR template and issue forms change what contributors see. The ruff hook only affects Claude Code sessions in this repo.

How to revert

Revert the commit.

Follow-ups needing repo settings

• Enable private vulnerability reporting (needed by SECURITY.md and the issue form's security link).
• Decide whether the changelog validation step becomes a required check on master.
• Confirm which branch protection applies to master.
• Review intent/review-process/intent.md and accept, reshape or close it.

Checklist

• Local CI sessions pass.
• A changelog fragment exists (+ai-native-sdlc.infrastructure.md).
• Documentation is updated.

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

The broken .gitignore pattern no longer excludes .env, allowing local B2 credentials to be accidentally staged and committed.

2 open issues

• Use non-interactive nox documentation checks to run coverage · New
• Redact SSE-C encryption keys in headers and request bodies · New

What changed in this PR

1 Important, 2 Nits, 0 Pre-existing. Checked the supplied changes and relevant implementation for #634; no tests or live-B2 checks were run.

This PR establishes contributor and coding-agent workflows for b2sdk without changing library code. Repository-setting changes remain proposals for maintainers.

Changes:

• Adds agent guidance, review standards, reusable skills, and intent/spec/plan templates.
• Documents release and security processes and adds contributor-facing templates and policies.
• Configures a Claude Ruff hook and editor settings.

File	Description
SECURITY.md	Defines security reporting, support, and handling guidance.
REVIEW.md	Defines review passes, evidence, and resolution rules.
RELEASE.md	Documents release preparation and publishing.
README.release.md	Removes the superseded release instructions.
intent/​review-process/​intent.md	Proposes risk-based review and repository settings.
intent/​README.md	Provides intent, specification, and plan templates.
docs/​review-lessons.md	Collects recurring review lessons.
CONTRIBUTING.md	Adds agent workflow and local verification guidance.
CODE_OF_CONDUCT.md	Establishes community conduct and reporting policies.
CLAUDE.md	Points Claude to shared repository guidance.
changelog.d/​+ai-native-sdlc.infrastructure.md	Records the tooling and policy additions.
AGENTS.md	Maps architecture, commands, and contributor conventions.
.gitignore	Changes local-file ignore patterns.
.github/​pull_request_template.md	Prompts for testing, risk, and rollback details.
.github/​ISSUE_TEMPLATE/​task.yml	Adds a maintenance task form.
.github/​ISSUE_TEMPLATE/​feature_request.yml	Adds a feature request form.
.github/​ISSUE_TEMPLATE/​config.yml	Routes security and service reports.
.github/​ISSUE_TEMPLATE/​bug_report.yml	Collects versions, reproductions, and sanitized logs.
.editorconfig	Defines shared whitespace and encoding settings.
.claude/​skills/​sdlc-subagents/​SKILL.md	Guides parallel sessions and scoped helpers.
.claude/​skills/​sdlc-spec/​SKILL.md	Guides requirements and design drafting.
.claude/​skills/​sdlc-pr-review/​SKILL.md	Guides structured reviews and comment resolution.
.claude/​skills/​sdlc-policy-skill/​SKILL.md	Guides policy skills and automated enforcement.
.claude/​skills/​sdlc-plan/​SKILL.md	Defines implementation planning and verification evidence.
.claude/​skills/​sdlc-intent/​SKILL.md	Guides problem and constraint capture.
.claude/​skills/​sdlc-feedback-loop/​SKILL.md	Defines test-first verification practices.
.claude/​skills/​sdlc-claude-md/​SKILL.md	Guides repository-context maintenance.
.claude/​skills/​ai-native-sdlc/​SKILL.md	Routes changes through workflow stages.
.claude/​settings.json	Registers the post-edit Ruff hook.
.claude/​hooks/​ruff.sh	Checks edited Python files with Ruff.

_{Review effort: Balanced}

[goanpeca]

Copilot overview finding (broken .gitignore pattern): fixed in 9388943. The appended .DS_Store line had merged with the final .env entry (no trailing newline), so .env was no longer ignored; both are separate entries again and git check-ignore confirms them.

[Copilot]

🟡 Changes recommended

Critical workflow flaws can let later commits pass without security analysis or suppress new vulnerability findings, while review metrics omit human replies and mishandle post-merge or pending reviews.

4 open issues

• Deduplicate individual findings instead of suppressing entire PR reports · New
• Enable per-commit scanning to prevent unscanned successful retries · New
• Fetch and count all comments in review threads · New
• Filter reviews by submission time before calculating metrics · New

2 resolved since last review

• Redact SSE-C encryption keys in headers and request bodies
• Use non-interactive nox documentation checks to run coverage

_{Review effort: Balanced}