[cmdr-chara]

Summary

Upgrade the existing review-and-refactor-code skill with an evidence-first PR review workflow inspired by Anthropic's How the Claude Code team does code review (published 2026-10-15).

• Verify reachable defects against the diff, repository context, contracts, guards, callers and counterexamples before reporting.
• Scale Quick / Standard / Deep review effort to consequences and reversibility, without conflating review depth with human approval authority.
• Start reviews with an actionable finding count (including zero) and distinguish introduced regressions, pre-existing issues and unverified hypotheses.
• Allow optional fresh-context, read-only independent checking for material risks, without falsely claiming independence when unavailable.
• Re-review new deltas and affected invariants; retain finding IDs and stop agent review/fix churn after three substantive rounds.
• Add opt-in REVIEW.md guidance, a repository-specific REVIEW.md, and a PR template covering testing, risk and rollback.
• Add routing, overlap and end-to-end workflow evaluation cases. Preserve existing security-review, debugging and final release ownership.

No new overlapping skill, GitHub bot, runtime integration or dependency is added.

Testing

• Inspected the Git tree and compared it with main: exactly 13 intended files changed, four added, zero removed/unexpected.
• Read back every changed Git blob and checked required SKILL.md sections, all referenced local paths, JSON parsing, evaluation ID uniqueness, zero-finding behavior and three-round stop: passed.
• Ref/commit diff comparison: one commit ahead of main, no unrelated dependency or generated file changes.
• Pending GitHub CI: full structural skill validator, smoke tests and package/installer checks.
• Not performed: a real-model live PR-review benchmark or proof of improved defect recall. CI does not establish those outcomes.

Risk

Low-to-medium, limited to agent instructions, evaluation corpus and PR documentation. No executable runtime code or permissions change. Key residual risk is that model behavior and routing precision require live-client evaluation.

How to revert

Revert commit 5190cbe43fab0801cac6822b44b68ffab41c7b84 on this branch if it proves incompatible. No migration or data change is involved.

Review notes

• Keep the existing skill name and refactor AWAITING_APPROVAL boundary.
• A reviewer does not approve or merge PRs on behalf of people. Repository protection remains the source of enforcement.
• Please do not merge automatically; awaiting maintainer review.

Summary by CodeRabbit

• New Features
  • Added an evidence-first pull request review workflow with risk-adjusted review depth, verified findings, and a limit of three automated fix-and-review rounds.
  • Added an optional repository review policy template and guidance for documenting review scope, testing evidence, risks, and rollback details.
• Documentation
  • Clarified that reviews do not grant approval to merge or release, and do not enforce platform protections or replace human sign-off.
  • Added examples covering review routing, security assessments, and release-readiness checks.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: bdb46ad4-d575-42a7-98c8-9a6a3e2fe656

📥 Commits

Reviewing files that changed from the base of the PR and between d149af1 and 9cb233a.

📒 Files selected for processing: 13

• .github/PULL_REQUEST_TEMPLATE.md
• README.md
• REVIEW.md
• docs/research-ledger.md
• evaluations/adversarial-review.md
• evaluations/overlap-cases.json
• evaluations/routing-cases.json
• evaluations/workflow-scenarios.md
• orchestration/workflows.md
• skills/llms.txt
• skills/review-and-refactor-code/SKILL.md
• skills/review-and-refactor-code/references/pr-review-protocol.md
• skills/review-and-refactor-code/references/review-policy-template.md

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

📝 Walkthrough

The changes define an evidence-first PR review workflow with risk-adjusted checks, verified findings, and a three-round limit on automated review and fixes. They add repository review guidance and PR template prompts, clarify review, security, and release boundaries, and extend routing and workflow evaluations.

Changes: Pull Request Review

Layer / File(s)	Summary
Review workflow and protocol skills/review-and-refactor-code/SKILL.md, skills/review-and-refactor-code/references/pr-review-protocol.md, orchestration/workflows.md, skills/llms.txt	The skill and protocol define review scope, risk-adjusted scrutiny, evidence-backed findings, and a three-round limit. They distinguish review authority from edit, security, and release responsibilities.
Repository review guidance and templates skills/review-and-refactor-code/references/review-policy-template.md, REVIEW.md, .github/PULL_REQUEST_TEMPLATE.md, README.md, docs/research-ledger.md	The policy template, repository guidance, and PR template describe review evidence, scope, risk, recovery, and authority boundaries. The README and research ledger document the workflow and its limits.
Routing and workflow evaluations evaluations/routing-cases.json, evaluations/overlap-cases.json, evaluations/workflow-scenarios.md, evaluations/adversarial-review.md	The evaluations add cases for read-only PR review, bounded re-review, security-specific routing, review followed by release assessment, and evidence-backed findings.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Feature

Merge Risk: ⚪ Minimal · up to 9cb23

This PR updates review guidance and evaluation examples rather than runtime behavior. The review-round limits and approval handoffs are consistent, with no actionable merge-blocking risk identified.

### Architecture Summary

Architecture risk: 🔵 Low · up to 9cb23

The change affects 6 systems.

Changed systems: evaluations, skills, docs, orchestration, README.md, REVIEW.md

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — evaluations (service) was modified; 4 changed files map to changed impact.
• observed — skills (service) was modified; 4 changed files map to changed impact.
• observed — docs (service) was modified; 1 changed file maps to changed impact.
• observed — orchestration (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

• observed — Modified behavior in README.md: The catalog description now says the skill reviews PRs with verified findings and bounded re-review, replacing its description of reviewing a defined area and making behavior-preserving refactors.
• observed — Modified behavior in README.md: Adds a section describing evidence-first PR review: risk-adjusted review depth, code-path validation of suspected bugs, introduced-versus-pre-existing issue distinction, and a stop after three substantive agent fix/review rounds. It links the protocol, policy guide, repository REVIEW.md, and PR template, and clarifies that the upgrade does not install an automatic review bot or enforce GitHub protection or human approval.
• observed — Modified behavior in REVIEW.md: Adds the policy’s scope: it guides reviewers who explicitly read it, is not an enforcement mechanism, and yields to applicable AGENTS.md instructions.
• observed — Modified behavior in REVIEW.md: Lists failure modes to prioritize, including incorrect specialist routing or bypassed safeguards, unsupported completion claims, unsafe instructions, portability or documented-contract violations, and evaluations that hide failures.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main changes: evidence-first PR findings and limits on review convergence.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (13 skipped: 13 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{I’m a rabbit with a checklist, neat and bright,
I test each claim against the diff in sight.
I count three rounds, then gently pause,
And keep review apart from merge-day laws.
I nibble clover, pleased with evidence in view.}

_{Comment @coderabbitai help to get the list of available commands.}