feat: add glance-review workflow with code and spec review skills

[CyrilRoelandteNovance]

Create a complete glance-review workflow following the nova-review pattern:

• Add glance-code-review skill for reviewing Glance code changes
• Add glance-spec-review skill for reviewing glance-specs proposals
• Add glance-core and glance-coresec agent personas
• Add knowledge/glance.md with Glance architecture and glance_store details
• Add Cursor symlinks for skill discovery
• Configure workflow with MCP integration support

The workflow focuses on multi-tenant isolation, database migrations,
store driver boundaries, and security review for Glance changes.

Key knowledge additions:

• Document glance_store as separate library for store drivers
• Remove placeholder notes (all content is now real/verified)
• Fix config path (glance uses glance/opts.py, not glance/conf/)

Note: This is largely a proof of concept. The skills are very similar to
their Nova counterparts (glance-code-review ≈ nova-code-review,
glance-spec-review ≈ nova-spec-review) with Glance-specific adaptations.
Tested with Claude Code only; not yet tested with Cursor or ACP.

Co-Authored-By: Claude Sonnet 4.5 noreply@anthropic.com

[sbauza]

Thanks for the contribution! The workflow structure is solid and follows the established patterns well. Here's my review organized by severity.

Blockers (must fix before merge)

1. Missing .cursor/agents/ symlinks for Glance personas

PR #28 (just merged) established that Cursor 3.x requires .cursor/agents/ symlinks for agent discovery. The PR adds agents/glance-core.md and agents/glance-coresec.md but doesn't create the corresponding symlinks:

.cursor/agents/glance-core.md → ../../agents/glance-core.md
.cursor/agents/glance-coresec.md → ../../agents/glance-coresec.md

2. Missing updates to main README.md

The PR adds a new workflow and 2 new personas but doesn't update any of the main README tables:

• Available Workflows table — needs a glance-review row
• All Available Skills table — needs glance-code-review and glance-spec-review rows
• Persona Reference table — needs Glance Core Reviewer and Glance Core Security rows
• Shared Agent Personas table — needs both Glance personas

3. Missing updates to root AGENTS.md

The Available Personas table needs Glance Core Reviewer and Glance Core Security entries.

4. Missing updates to agents/README.md

The Available Personas section needs entries for both new Glance personas, following the existing format (description, key behaviors, "Used by" line).

Should fix

5. CLAUDE.md formatting inconsistency

The two @ references are on consecutive lines with no blank line between them. Nova's CLAUDE.md separates them with a blank line:

@../../rules.md

@AGENTS.md

6. README.md line 62: stale Cursor discovery docs

Says "Agent personas are auto-detected from agents/." — should say "discovered via symlinks in .cursor/agents/" per PR #28.

7. rules.md has premature REST API fallback sections

The rules.md copies nova-review's sections about HTTP authentication, credential prompting, and retry logic for a /glance-gerrit-comment skill that doesn't exist yet. These 20+ lines of rules for non-existent functionality add noise. Better to add them when the skill is actually created. The "Future: Review Posting" framing is fine in the README, but rules.md should only contain rules for things that exist.

8. knowledge/glance.md — missing key architectural concepts

The knowledge file is solid on glance_store and basics, but misses some important Glance-specific concepts:

• Image import workflow (glance/async_/) — staged upload, web-download, glance-direct, copy-image. This is one of Glance's most complex subsystems.
• Hacking checks — Glance has its own G3xx codes in glance/hacking/checks.py (similar to Nova's N-codes). Worth mentioning as a deterministic check that CI handles.
• Image tasks — async operations framework
• Metadefs — metadata definitions namespace (separate API)
• Config location — the PR correctly says glance/opts.py, but should also mention glance/common/config.py where options are actually defined

9. glance-core.md — could be strengthened with Glance-specific patterns

• G3xx hacking checks reference (like nova-core.md references N-codes)
• Image import flow review patterns (this is where most complex Glance bugs live)
• Reference to Glance-specific review guidelines in doc/source/contributor/ if they exist in-tree

What's good

• Follows established patterns well — directory structure, SKILL.md frontmatter, ambient.json fields all match conventions
• Skill naming uses glance- prefix correctly, consistent with our naming convention
• glance_store separation is well documented — this is a critical architectural detail many contributors miss
• Multi-tenant isolation correctly identified as the top security concern
• "Do not duplicate deterministic checks" principle respected throughout
• Human approval gates properly implemented (no auto-posting)