review-pr · diff
git:20260918.3d0a887 to git:20260919.f99d2e7
31 added, 47 removed. Audit A to A.
---
name: review-pr
description: Recommend the right reviewer set for a PR from what it touches. Outputs a concrete plan (1 reviewer by default, plus the security reviewer or all three axes when a trigger fires) with ready-to-paste Agent dispatch prompts.
argument-hint: "<PR-number>"
---
# PR Review Recommendation
- Decide how much review rigor a PR warrants and surface the dispatch prompts.
- The recommendation says what a PR needs AT MINIMUM.
+ Decide how much review rigor a PR warrants and surface the dispatch prompts. The
+ recommendation says what a PR needs AT MINIMUM.
- **The recommended set is a FLOOR, not a cap, and wall-clock / token cost is
- never a reason to come in under it or to stop at it** (CLAUDE.md → "Cost is
- not a tiebreaker"): when unsure, add the axis. Reviewers are read-only agents
- that run in parallel.
+ **The recommended set is a FLOOR, not a cap, and wall-clock / token cost is never
+ a reason to come in under it or to stop at it** (CLAUDE.md, "Cost is not a
+ tiebreaker"): when unsure, add the axis. Reviewers are read-only agents that run
+ in parallel.
- The skill itself never spawns reviewers — it reads PR stats, applies the
- heuristic, and prints a recommendation; the **main session orchestrator**
- issues the `Agent` calls, extending the dispatch templates in
+ This skill never spawns reviewers — it reads PR stats, applies the heuristic, and
+ prints a recommendation. The **main session orchestrator** issues the `Agent`
+ calls, extending the templates in
[references/output-template.md](references/output-template.md) with PR-specific
context.
- ## How this skill is packaged
-
- This file is a thin orchestrator. The per-stage detail lives under
- `references/`, and **reading a stage's file at stage entry is MANDATORY, not
- optional** — the one-line summaries below are routing, not the procedure. Each
- file carries the trigger lists, the shell, and the measured incidents behind
- them, and a step executed from the summary alone will get the reviewer set
- wrong.
-
- Splitting it was forced rather than stylistic: at 22,994 B this file sat 6 bytes
- under its cap, and go-to-k/cdkd#3169 measured the cost — six drafts of one
- needed clause were all refused, and two of the squeezes that did land damaged a
- sentence (one dropped a word, one left a selector vacuously true). A file that
- can only accept edits which shrink it accumulates more of those.
+ The per-stage detail lives under `references/`, and **reading a stage's file at
+ stage entry is mandatory** — the one-line summaries below are routing, not the
+ procedure.
## Steps
0. **Is it your turn?** A PUSH is not a round-completion signal — a REPLY is.
Read [references/round-completion.md](references/round-completion.md) and
- apply it BEFORE opening a round on a head you have not reviewed. Skip the
- wait only on the conditions it names.
+ apply it BEFORE opening a round on a head you have not reviewed.
1. **Read the PR** — `paths` above all, plus `loc` / `fc` for context and the
touched `src/` files' recent history. Commands and their traps:
[references/pr-stats.md](references/pr-stats.md). The history probe is
mandatory: it is the one step-3 signal not readable off `paths`.
- 2. **Default: ONE reviewer** (`pr-code-reviewer`, a single code-quality pass).
- **Size selects nothing** — the old LOC / file-count ladder is gone, so a
- 4000-LOC PR and a 40-LOC PR both start here, and a docs-only or test-only
+ 2. **Default: ONE reviewer** (`pr-code-reviewer`). A docs-only or test-only
diff is not discounted below it.
- 3. **Triggers** from the `paths` list —
+ 3. **Triggers** from the `paths` list and the `src/**` size —
[references/bias-factors.md](references/bias-factors.md), read at this step
- and AUTHORITATIVE for every list below; this summary is routing.
+ and AUTHORITATIVE for every list below.
+ - **Size**: the `src/**` diff exceeds 400 lines OR 8 files → add
+ `pr-spec-reviewer` + `pr-test-reviewer` (all three axes).
- **Security add-on** (`pr-security-reviewer`, additive to whatever else
- runs): a security / process-launch surface, `src/provisioning/providers/**`,
- or a PR that IS a security fix. **A security blocker stops the merge like
- any other.**
- - **All three axes** (spec + code + test in parallel): a state-schema bump,
- or a security fix. Nothing else reaches 3-axis by rule — but the set is a
- floor, so add an axis whenever the judgement signals in that file fire.
+ runs): a secret / credential / redaction / masking / sensitive-value
+ persistence / process-launch surface, `src/provisioning/providers/**`, or a
+ PR that IS a security fix. A security blocker stops the merge like any
+ other.
+ - **All three axes plus security**: a state-schema bump, or a security fix.
- 4. **Resolve the set**: default one reviewer → plus `pr-security-reviewer` when
- its trigger fired → all three axes when a schema bump or security fix is in
- play (a 3-axis security fix dispatches four reviewers, not three).
+ 4. **Resolve the set**: default one reviewer, plus the size axes when the size
+ trigger fired, plus `pr-security-reviewer` when its trigger fired (a 3-axis
+ security fix dispatches four reviewers, not three). Reviewers run ONCE, on
+ the FINAL sha: a fix round is re-checked by messaging the SAME reviewer with
+ the delta (`SendMessage`), never by a fresh dispatch.
- 5. **Render the recommendation** — format in
+ 5. **Render the recommendation** —
[references/output-template.md](references/output-template.md).
6. **Dispatch reviewers and synthesize** —
- [references/dispatch-and-marker.md](references/dispatch-and-marker.md).
- NEVER report a round closed without dispatching the reviewers first.
-
- ## Output template
-
- The recommendation format and the per-reviewer dispatch prompts are in
- [references/output-template.md](references/output-template.md).
+ [references/dispatch-and-marker.md](references/dispatch-and-marker.md). NEVER
+ report a round closed without dispatching the reviewers first.