review · diff

git:20260918.5b7b57d to git:20261023.bbc2e64

38 added, 99 removed. Audit A to A.

---
name: review
- description: 'Manage devloop automated code-review runs and findings on GitHub/GitLab PRs/MRs: inspect or run a review, independently verify every published finding, record a Verdict, handle valid findings, resolve completed threads, or report missed findings. Use when Review/Review findings context surfaces, or the user asks to run review, process review comments/findings, review and fix, adjudicate, label, or 打标. Not for a direct architecture/code review without devloop artifacts; use code-taste for that.'
+ description: 'Manage devloop automated review runs and published GitHub/GitLab findings: inspect or run review, verify findings, record Verdicts, fix issues, resolve threads, or report missed findings. Use for surfaced Review context, review findings/comments, adjudication, or 打标. For direct code/architecture review without devloop artifacts, use code-taste.'
---
- devloop review has one lifecycle:
-
- ```text
- ReviewRun → Finding → Verdict → Handling → thread resolution
- ```
-
- `ccr:label=` is only the Forge encoding of a Verdict. Never format it manually and never use
- generic `pr reply` for adjudication; the review CLI validates the vocabulary and keeps recording a
- Verdict separate from resolving the discussion.
-
- `<PLUGIN_ROOT>` maps to `${CLAUDE_PLUGIN_ROOT}` on Claude Code and `${PLUGIN_ROOT}` on Codex.
-
- ## Routes
-
- ### Surfaced ReviewRun result
-
- When context contains `Review: ...`, treat it as advisory information, not control transfer:
+ ReviewRun → Finding → Verdict → Handling → thread resolution.
+ A Verdict records validity/severity; it does not mean the issue is fixed or the thread resolved.
- - `running` → leave it alone;
- - `stale` → report that the background run likely died and can be rerun;
- - `clean` → no action;
- - failed files / `error` → report incomplete coverage; never call it clean;
- - findings → inspect the real diff/code before reporting them.
+ Use `<PLUGIN_ROOT>/scripts/python <PLUGIN_ROOT>/scripts/review.py` below; `<PLUGIN_ROOT>` is
+ `${CLAUDE_PLUGIN_ROOT}` on Claude Code and `${PLUGIN_ROOT}` on Codex. The CLI owns Forge encoding
+ and durable Verdict replies; do not hand-write `ccr:label=` or edit local ground-truth datasets.
- Use the Verdict vocabulary below instead of inventing a High/Medium/Low truth model. By default,
- report the result briefly and return control. Modify code only when the user asks to fix or process
- the findings.
+ ## Inspect or run
```bash
<PLUGIN_ROOT>/scripts/python <PLUGIN_ROOT>/scripts/review.py status
<PLUGIN_ROOT>/scripts/python <PLUGIN_ROOT>/scripts/review.py run [--background '<context>']
```
- Normal lifecycle hooks launch the same ReviewRun automatically; do not duplicate a visible
- `running` run.
-
- ### Published Findings awaiting Verdicts
-
- 1. **List published Findings**:
-
- ```bash
- <PLUGIN_ROOT>/scripts/python <PLUGIN_ROOT>/scripts/review.py findings <n|url> --pending
- <PLUGIN_ROOT>/scripts/python <PLUGIN_ROOT>/scripts/review.py findings <n|url>
- ```
-
- 每行是 `<comment-id> [PENDING|verdict] <path>[:<line>] ccr:fp=<fp>`,`<comment-id>`
- 就是下一步的定位符。GitLab/GitHub 同一套写法,不用分别拼 `gh api` / `glab api`。
-
- Read a finding's complete body and replies before adjudicating:
-
- ```bash
- <PLUGIN_ROOT>/scripts/python <PLUGIN_ROOT>/scripts/pr.py comment <n|url> <comment-id> [--repo <name|path>]
- ```
-
- `.devloop/review.json` 只用于辅助求证;**仅存在本地、没发布成 comment 的 finding 不打标**
- ——它没有可回复的对象,采集侧也看不见。
-
- 2. **Adjudicate every pending Finding independently**:
- - 必须对照真实 diff/代码求证,**不能顺着 finding 文本信**——这是打标的头号失效模式:
- review 是模型写的,你也是模型,附和它会让 ground truth 退化成"模型认同模型",
- 整个评测基准就白做了;
- - 论证扎实但在实际执行路径上不成立的判 wrong("教科书事实错套"是最常见误报形态);
- - diff 之前已存在、不是本次改动引入的行为不算有效 finding,判 wrong 并用
- `#out-of-diff` 说明 attribution 反证;
- - 同一 MR 的更早 comment 已交付同一问题,判 repeat 并指向那条 comment;
- - 拿不准判 debatable,不要硬判。
-
- 3. **Record its Verdict without resolving the thread**:
-
- ```bash
- <PLUGIN_ROOT>/scripts/python <PLUGIN_ROOT>/scripts/review.py label <n> <comment-id> wrong \
- --reason '该分支实际走不到,xxx.py:42 已早返回 #textbook'
- ```
+ Lifecycle hooks already launch reviews. Do not duplicate a running run. Surfaced context is
+ advisory: report verified findings or incomplete coverage without taking over the current task.
+ An error or failed-file result is not clean; a stale run may need rerunning. Code changes require
+ a request to fix/process findings.
- `important` / `minor` describe validity and severity independently of whether a fix has already
- been made. The five Verdicts are:
+ ## Adjudicate and handle
- - `important`: valid, substantive defect;
- - `minor`: valid but small;
- - `debatable`: judgment call or defensive suggestion;
- - `wrong`: false positive with concrete counter-evidence;
- - `repeat`: already delivered by an earlier Finding in this PR/MR, with its comment id/link.
+ ```bash
+ <PLUGIN_ROOT>/scripts/python <PLUGIN_ROOT>/scripts/review.py findings <n|url> [--pending]
+ <PLUGIN_ROOT>/scripts/python <PLUGIN_ROOT>/scripts/pr.py comment <n|url> <comment-id>
+ <PLUGIN_ROOT>/scripts/python <PLUGIN_ROOT>/scripts/review.py label <n> <comment-id> <verdict> --reason '<evidence>'
+ <PLUGIN_ROOT>/scripts/python <PLUGIN_ROOT>/scripts/review.py resolve <n> <comment-id> [--fixed]
+ ```
- 理由里可带病因 tag:`#textbook` `#padding` `#out-of-diff` `#stale` `#cross-file`。
+ Read the full finding and replies, then verify against the actual diff and execution path.
+ Only published, independently replyable Finding threads can receive Verdicts; local-only findings
+ and summary-note fallback text have no reply target.
- 4. **Handle and resolve separately**:
+ | Verdict | Meaning |
+ |---|---|
+ | `important` | Valid, substantive defect |
+ | `minor` | Valid, small defect |
+ | `debatable` | Uncertain judgment or defensive suggestion |
+ | `wrong` | False positive, supported by counter-evidence |
+ | `repeat` | Same issue already delivered in an earlier comment on this PR/MR; cite it |
- - `wrong` / `repeat` / `debatable`: the reason completes the no-code disposition; resolve it;
- - `important` / `minor`: modify code only when authorized, validate, publish through the normal
- git workflow, then resolve with `--fixed`;
- - a valid Finding whose fix is not yet published remains unresolved.
+ A behavior predating the diff is `wrong` with `#out-of-diff` attribution evidence.
+ An already fixed valid defect remains `important`/`minor`.
- ```bash
- <PLUGIN_ROOT>/scripts/python <PLUGIN_ROOT>/scripts/review.py resolve <n> <comment-id>
- <PLUGIN_ROOT>/scripts/python <PLUGIN_ROOT>/scripts/review.py resolve <n> <comment-id> --fixed
- ```
+ For `wrong`/`repeat`/`debatable`, record the reason and resolve without a code fix.
+ For `important`/`minor`, leave the thread open until an authorized fix is validated and published
+ through [git-ops](../git-ops/SKILL.md), then resolve with `--fixed`.
- 5. **收口**:再运行上述 `findings <n> --pending`,返回空即结束。不运行 ccr `eval/labels.py`,不手工修改
- `eval/labels/*.jsonl`,不在当前流程提交 ground truth;ground truth 由后续的集中采集任务
- 统一查询 API 产生。
+ `--pending` means no Verdict. Empty pending output completes adjudication only. For a fix request,
+ also check all relevant findings and thread states: report published fixes, resolved threads,
+ and any valid issues still outstanding. Review never merges the proposal.
- ### Missed Finding
+ ## Report a missed finding
```bash
- <PLUGIN_ROOT>/scripts/python <PLUGIN_ROOT>/scripts/review.py missed <n> \
- --path path/to/file.py --line 42 --reason '<concise evidence>'
+ <PLUGIN_ROOT>/scripts/python <PLUGIN_ROOT>/scripts/review.py missed <n> --path <file> --line <line> --reason '<evidence>'
```
-
- ## Boundaries
-
- - Only independent replyable Finding threads carry Verdicts. Summary-note fallback text has no
- reply target and is excluded from `review findings`.
- - Forge Finding + Verdict replies are the durable source for continuous-review history and later
- ground-truth collection. Do not edit local label datasets in this workflow.
- - `review` owns ReviewRun/Finding/Verdict policy. Generic PR/MR show/update/close/reply stays in
- `git-ops`; commit/push and validation use their existing skills.
- - Review remains advisory and never merges a PR/MR.