review: read per-directory REVIEW.md contracts from the consuming repo

.changeset/review-computed-verdict.md

@@ -0,0 +1,5 @@
+---
+"review": minor
+---
+
+Make the review verdict a deterministic computation instead of a model judgment: structured findings flow through a computed verdict (severity/confidence truth table, with a hold-for-human outcome for policy conflicts), templated comment rendering, and a missing-dimension gate that refuses to conclude when a required review dimension produced no findings and no explicit all-clear. The model authors findings; code decides the verdict and renders the comments.

.changeset/review-deterministic-router.md

@@ -0,0 +1,5 @@
+---
+"review": minor
+---
+
+Add the deterministic review router (`workflows/review/lib/router.ts`): pure TypeScript that classifies changed files (generated vs source via .gitattributes), selects which specialist lenses to spawn by touched paths, maps owning teams from REVIEWERS rules (subsuming the old reviewer-mapper sub-agent), assigns per-file risk tiers, and computes one run budget scaled by the highest touched tier with a misrouted-PR floor. Diff-direction-dependent tiers are deferred to a single small-model call instead of guessed.

.changeset/review-finding-schema-foundations.md

@@ -0,0 +1,5 @@
+---
+"review": minor
+---
+
+Add the versioned structured finding schema (`workflows/review/lib/finding-schema.ts`): every sub-agent finding now carries id, lens, anchor (line/range/file/pr-level), severity, confidence, evidence trace, optional suggested patch and pre-merge obligation, validated against an exported `FINDING_SCHEMA_VERSION`. Review submission is standardized on a single robust `submit-pull-request-review` call with a guaranteed non-empty body (the empty-body retry fallback is removed), and PR context (`pr-context.json`) is staged on disk once per run for all sub-agents, extending the existing diff staging.

.changeset/review-full-eval-suite.md

@@ -0,0 +1,5 @@
+---
+"review": minor
+---
+
+Add the full eval suite under `workflows/review/eval/`: a four-dataset corpus (incidents, synthetic mutations, golden PRs, known-clean, plus an adversarial holdout), five pure metrics (must-catch recall, golden precision, clean false-block, noise, confidence calibration with ECE), an LLM judge with an injected model seam pinned to Opus 4.8 (audit sampling and thumbs calibration included), and release gates (adversarial hard gate for automatic mode, overfitting advisory). The deterministic suite runs on every PR through the normal test runner (node-ci); the live judge runs weekly via `.github/workflows/review-eval-full.yml` and the committed `workflows/review/eval/live-judge.ts` entry point, reporting to the job summary.

.changeset/review-investigation-cap.md

@@ -0,0 +1,5 @@
+---
+"review": minor
+---
+
+Bound reviewer investigation (R9): sub-agents get explicit instructions for cheap targeted verification (grep callers, trace the call chain, one targeted check per finding), and `workflows/review/lib/investigation-cap.ts` enforces a deterministic per-finding and per-run tool-call cap sourced from the router's run budget. Over-cap calls are refused with fixed reason codes and refusals never mutate state.

.changeset/review-md-contracts.md

@@ -0,0 +1,5 @@
+---
+"review": minor
+---
+
+Read per-directory `REVIEW.md` review contracts from the consuming repo. When the checkout carries them (a root `REVIEW.md` plus per-directory ones, as in webapp's agent-doc surface), the `correctness-reviewer` reads the root contract plus the nearest `REVIEW.md` above each reviewed file to calibrate what is Important versus a nit in that sub-tree, and the `claim-validator` uses the same contracts to calibrate claim labels (never `verification`, which stays code-evidence-only). Contract text can adjust emphasis but never overrides the workflow's rules, and since these files are read from the PR head, an edited `REVIEW.md` is itself reviewed on its merits. Repos without `REVIEW.md` files are unaffected.

.changeset/review-p2-items.md

@@ -0,0 +1,5 @@
+---
+"review": minor
+---
+
+P2 items: the thread-reconciler recognizes three terminal resolutions (fixed, deferred-to-filed-issue, disagreed-with-reason) before keeping a thread open; the guidance comment carries a plain version marker (release tag + finding-schema version) for attribution and rollback, with semver as the behavior contract (no drift-stamp machinery); `lib/counters.ts` mines run health metrics (validator drop rate, comments per PR, verdict mix, thumbs agreement, cost) from existing per-run artifacts; and APPROVE-with-obligations renders pre-merge obligations as a distinct comment from the finding schema. Dismissal-learning is deferred until the thumbs sweep is scheduled and has accumulated real dismissal signals.

.changeset/review-roster-framework.md

@@ -0,0 +1,5 @@
+---
+"review": minor
+---
+
+Restructure the reviewer roster: five always-on reviewers (holistic, completeness, test-adequacy, first-principles, conventions) with explicit trust and advisory constraints and named mandates; launch-default model and effort assignments per role (Opus 4.8 workhorse, xhigh for the security lens and claim validation, Fable 5 for first-principles); and the kept gates (pattern-triage, claim-validator, deterministic dedup, verdict bookends, thread-reconciler) wired to the new roster.

.changeset/review-smoke-benchmark.md

@@ -0,0 +1,5 @@
+---
+"review": minor
+---
+
+Add the smoke benchmark: a 13-case tagged subset of the eval corpus (incident repros, adversarial-injection PRs, known-clean PRs) in the shared dataset format, a no-post runner that replays cases through the real deterministic review path (router, labels, scope filter, verdict, render) with zero GitHub writes, and a vitest gate (`workflows/review/eval/smoke.test.ts`) that asserts each case's computed verdict against its expected block. A dedicated CI entry point is staged at `.github-staging/review-smoke.yml` pending a human `git mv` into `.github/workflows/`.

.changeset/review-specialist-lenses.md

@@ -0,0 +1,5 @@
+---
+"review": minor
+---
+
+Add the eleven path-routed specialist reviewer lenses: security-auth (single lens, xhigh effort), ai-safety-moderation, mass-comms-coppa, caching-resource, data-migrations, concurrency-async, api-federation-compat, cross-deploy-serialization, deploy-infra-config, money-payments, and content-i18n. Each lens runs a tri-state incident hunt (found / not-found / not-applicable) and emits schema-validated structured findings; the standalone skill-auditor sub-agent is folded into the correctness pass, keeping the repo-specific correctness-checks extension point.

.changeset/review-wave1-prompt-edits.md

@@ -0,0 +1,5 @@
+---
+"review": patch
+---
+
+Reliability and quality prompt edits (wave 1): high-risk triggers are named then judged in one line (E1); prompt-injection attempts in the diff or PR description are themselves blocking findings (E3); deletions are findings (E5); bot threads are judged against the whole reply chain and a conceded point is never re-raised (E6); open human threads are deferred to instead of duplicated (E7); and pre-existing bugs on touched lines are in scope (R3b).

.changeset/review-wave2-rebalance.md

@@ -0,0 +1,5 @@
+---
+"review": patch
+---
+
+Recall/precision rebalance (wave 2): coverage-first hunting before filtering (E8), every blocking finding must state a concrete failing scenario (E9), three-state claim validation with symmetric evidence duties — refuted claims are dropped, uncertain ones downgraded to non-blocking, and only a validator-confirmed claim may carry a blocking label into the verdict (E10), claims are confirmed against the code before assertion (E11), findings cite exact lines (E12), and a posting bar keeps inline comments at confidence 0.5 or higher with low-confidence findings collapsed into one section (E13). An author-disputed claim cannot re-block unless the re-check traces to actual usage; otherwise it posts as a question. The planned blocking-claim refuter panel is removed rather than shipped (a production audit of 319 blocking claims found its addressable class was 2 claims; the confirmed-only verdict gate covers the rest at zero extra agents), with the eval suite's false-block metric as the tripwire for revisiting. The no-post runner gains a validation-replay stage and the smoke corpus gains six audit-seeded cases pinning the gate: production false blocks must approve, confirmed blocks must keep blocking.

.github-staging/review-smoke.yml

@@ -0,0 +1,40 @@
+# Review smoke benchmark (R5, task-9-4)
+#
+# STAGED FILE — NOT YET ACTIVE. It lives under `.github-staging/` because no
+# producer role in this pipeline may push to `.github/` directly (gateway phase
+# restriction, #2508). A human must move it into place for it to run:
+#
+#     git mv .github-staging/review-smoke.yml .github/workflows/review-smoke.yml
+#
+# (See the PR body's "Pre-merge obligations" note.) Until then the smoke set is
+# still enforced by the repo-wide `pnpm run test` gate in node-ci.yml, which runs
+# the same vitest suite; this dedicated entry point just makes the smoke gate
+# explicit and independently visible on every PR, and does not assume the
+# existing CI wiring.
+#
+# It runs the slice-9 smoke benchmark: the tagged smoke subset of the eval corpus
+# replayed through the no-post runner (workflows/review/eval/runner.ts), which
+# exercises the real deterministic review path (router -> labels -> scope filter
+# -> verdict -> render) and performs NO GitHub write. The vitest gate lives with
+# the eval harness (workflows/review/eval/) and asserts each smoke case's computed
+# verdict against its `expected` block.
+
+name: Review Smoke
+
+on:
+  pull_request:
+    paths:
+      - "workflows/review/**"
+      - ".github/workflows/review-smoke.yml"
+
+jobs:
+  smoke:
+    name: PR-reviewer smoke benchmark
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      - uses: ./actions/shared-node-cache
+      # Run only the review eval harness (loader + no-post runner + smoke cases).
+      # `--run` forces a single non-watch run; the path filter scopes vitest to
+      # the smoke gate so this job stays fast and focused.
+      - run: pnpm run test --run workflows/review/eval

.github/workflows/review-eval-full.yml

@@ -0,0 +1,39 @@
+# Review eval — scheduled live judge.
+#
+# The DETERMINISTIC eval suite (loadCorpus -> runCorpus -> computeMetrics ->
+# evaluateGates, plus the stub-judge composition checks) needs no secrets and
+# already runs on every PR via the normal test runner (`pnpm run test --run`
+# in node-ci.yml), so it has no job here.
+#
+# What runs here is the one thing normal CI cannot do: the same corpus run
+# scored by the LIVE pinned judge model (judge.ts PINNED_JUDGE_MODEL) through
+# the pure JudgeModel seam. Judge calls cost real money and must never gate
+# PRs, so this is deliberately off-PR on a weekly schedule. The entry point is
+# the committed script `workflows/review/eval/live-judge.ts` (lint/typecheck/
+# test-covered like any other source file); it appends the metrics/gates/judge
+# report to the job summary so results are visible without opening the log.
+
+name: Review Eval Live Judge
+
+on:
+  schedule:
+    # Weekly, Monday 09:00 UTC.
+    - cron: "0 9 * * 1"
+  workflow_dispatch: {}
+
+jobs:
+  live-judge:
+    name: Live judge over the full corpus
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      - uses: ./actions/shared-node-cache
+      - name: Run the live judge over the full corpus
+        env:
+          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+        run: |
+          if [ -z "$ANTHROPIC_API_KEY" ]; then
+            echo "ANTHROPIC_API_KEY secret not configured; skipping the live-judge run." >&2
+            exit 0
+          fi
+          pnpm dlx tsx workflows/review/eval/live-judge.ts

package.json

@@ -23,11 +23,8 @@
         "fast-glob": "^3.3.3",
         "memfs": "^4.51.0",
         "prettier": "^2.6.2",
+        "typescript": "^5.9.3",
         "vitest": "^4.0.10"
     },
-    "packageManager": "pnpm@10.0.0+sha512.b8fef5494bd3fe4cbd4edabd0745df2ee5be3e4b0b8b08fa643aa3e4c6702ccc0f00d68fa8a8c9858a735a0032485a44990ed2810526c875e416f001b17df12b",
-    "dependencies": {
-        "@swc-node/register": "^1.11.1",
-        "typescript": "^5.9.3"
-    }
+    "packageManager": "pnpm@10.0.0+sha512.b8fef5494bd3fe4cbd4edabd0745df2ee5be3e4b0b8b08fa643aa3e4c6702ccc0f00d68fa8a8c9858a735a0032485a44990ed2810526c875e416f001b17df12b"
 }