[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6DNJ0ASTPRHPCZN6CRKDRWQ":3,"skill-same:01M6DNJ0ASTPRHPCZN6CRKDRWQ":66},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":46,"commitSha":47,"skillDirectory":48,"forksCount":49,"repositoryHtmlUrl":50,"repositoryHomepageUrl":6,"ownerHtmlUrl":51,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":52,"install":53,"resources":65},"01M6DNJ0ASTPRHPCZN6CRKDRWQ","review-loop",null,"Review and fix the current branch until clean; use stack for an existing GitButler stack. Use review-pr for read-only PR assessment.","0xgleb\u002Fdotconfig","0xgleb","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F39841057?v=4","01M6DNDD83BRMM1SH4R4C6K8GY","01M6DNDDCPH33FEFB6JN6Y2GVD",3,"MIT","https:\u002F\u002Fgithub.com\u002F0xgleb\u002Fdotconfig\u002Fblob\u002Fmaster\u002Fai\u002Fskills\u002Freview-loop\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"review","review loop","loop","mktemp","but","git","edit","write","read","command","artifact","stack","review and fix","Bash","workflow","only","assessment","clean","fix","branch","2026-11-10 10:12:30",false,"---\nname: review-loop\nuser-invocable: true\nallowed-tools: Bash(but:*), Bash(direnv:*), Bash(git:*), Bash(gh:*), Bash(command:*), Bash(cargo:*), Bash(nix:*), artifact_provenance, Bash(cat:*), Bash(mktemp:*), Bash(rm:*), Bash(test:*), Bash(grep:*), Bash(wc:*), Bash(uuidgen:*), Bash(basename:*), Bash(find:*), Read, Write, Edit, Agent, Workflow, AskUserQuestion\ndescription: Review and fix the current branch until clean; use stack for an existing GitButler stack. Use review-pr for read-only PR assessment.\nargument-hint: [stack]\n---\n\nRun a full self-review loop on the current branch: review → auto-fix → CI →\nre-review → repeat until clean. Use this right before you push something you\nwrote yourself, to catch issues before reviewers do.\n\nThe **review engine** (panel, probes, prompts, the `review-panel` Workflow,\nfinding output) is shared with `\u002Freview-pr` and `\u002Freview-sweep` and lives in\n`~\u002F.claude\u002Fskills\u002Freview-core\u002FSKILL.md`. This skill **scopes the diff to the\ncurrent branch** and, after the engine returns findings, **takes the fix-loop\naction**: triage → fix → re-review until clean. Read `review-core` when a step\nsays \"run the review engine\".\n\nThe loop is **automatic by default**. Findings that clearly should be fixed are\nfixed without asking. The loop re-reviews after each fix pass to catch issues\nintroduced by the fixes themselves. It stops when a review pass returns no new\nactionable findings.\n\n**Speed design:** the **first pass** runs the native review panel, **adaptively\nsized to the diff** (small diffs run fewer lanes). Each finding is adversarially\nverified **before** triage so false positives never cost a fix-and-re-review\ncycle. Independent verification and repair proposals may run in read-only\nparallel lanes; the parent applies source edits centrally. A **compile gate**\nruns after each fix pass so a broken fix never burns a review pass, and a\n**formatter-only delta** is treated as verified by construction and skips the\npass entirely. **Re-review passes** run in fast delta mode (per-fix verifiers\nplus one broad sweep of the fix delta) and **escalate to a full independent\npanel pass** when the fix delta is large, scope grew, or it touched\nsecurity-sensitive paths. On an escalated full pass, the project's check command\noverlaps the panel concurrently.\n\n**Argument:** with no argument, the loop runs on the **current branch only**;\npublication requires independent repository or owner authority. With `stack`, it\nwalks every branch in the applied GitButler series sequentially, bottom to top,\nabsorbing each branch's verified fixes (see **Stack mode** below).\n\nFollow these steps precisely.\n\n---\n\n## Stack mode (`\u002Freview-loop stack`)\n\nWhen invoked with the `stack` argument, wrap the single-branch loop (steps 1–11)\nin an upstack walk: review-loop a branch, fold the fixes into its commit,\nadvance to the next branch, and repeat to the top of the stack. Passing `stack`\nis an explicit opt-in to the amend-and-advance flow, so in stack mode **hard\nrule #4 is relaxed**: you MAY absorb fixes into the current branch before\nadvancing (`but absorb`). Checkpoint timing and publication scope follow\n`GLOBAL_AGENTS.md`'s workspace workflow throughout the walk; final convergence\ndoes not defer an otherwise-required checkpoint. This skill alone does not\nauthorize draft→ready changes, new PRs or PR comments.\n\nWith no `stack` argument, skip this section entirely and run steps 1–11 once on\nthe current branch.\n\n### Detect the stacking tool\n\nUse GitButler in verified managed main worktrees and plain Git elsewhere. Follow\nthe mandatory whole-workspace publication rule in `GLOBAL_AGENTS.md`;\nrepository-local defaults do not override it. Detect topology before selecting\nstack mode (same detection as `\u002Freview-sweep`):\n\n```bash\nrepo_root=$(git rev-parse --show-toplevel)\ngit_common_dir=$(git rev-parse --path-format=absolute --git-common-dir)\nmain_root=$(git worktree list --porcelain | sed -n 's\u002F^worktree \u002F\u002Fp' | head -n1)\nif [ \"$repo_root\" != \"$main_root\" ]; then tool=none\nelif [ -d \"$git_common_dir\u002Fgitbutler\" ]; then\n  current_branch=$(git symbolic-ref --quiet --short HEAD) || {\n    echo \"Cannot establish the current branch; stop before choosing a workflow.\"\n    exit 1\n  }\n  case \"$current_branch\" in\n    gitbutler\u002F*) tool=gitbutler ;;\n    *) tool=none ;;\n  esac\nelse tool=none\nfi\necho \"stacking tool: $tool\"\n```\n\nGitButler is main-worktree-only: a linked, isolated, or scratch worktree routes\nto plain Git without probing `but`, even when its common Git directory belongs\nto a GitButler-managed main workspace.\n\n**`tool=none` (plain git):** there is no stack to walk. Tell the user this repo\nhas no stacking tool, run steps 1–11 once on the current branch (the normal\nsingle-branch loop), and stop — do not amend or advance.\n\nThe rest of this section branches on `$tool`. Each branch gets its own review\ndirectory (the step-2 `out_dir` is branch-named), its own diff against its own\nparent, and its own 4-pass cap. The Defer-to-GitHub step (10) still applies per\nbranch.\n\n### Stack adapter\n\n| Adapter operation          | GitButler managed main worktree                                                    |\n| -------------------------- | ---------------------------------------------------------------------------------- |\n| ready check                | verified main worktree on a `gitbutler\u002F*` workspace branch (`but status` succeeds) |\n| advance to next branch     | none — virtual branches are applied together                                       |\n| scope one branch's diff    | Git diff between verified parent\u002Fhead SHAs                                         |\n| absorb fixes into a branch | `but absorb \u003Cbranch>` (`--dry-run` first)                                          |\n| return to start            | none                                                                               |\n\n`but` is provided by the repo's flake\u002Fdevenv — if it is not on `PATH`, invoke it\nas `direnv exec \"$repo_root\" but …` for every `but` call. Never run `but setup`\n\u002F `but teardown` or otherwise change GitButler mode yourself.\n\n### Stack flow — [GitButler]\n\nAll virtual branches are applied at once, so there is no checkout\u002Fadvance — you\niterate the applied series in place.\n\nBefore any stack artifact is created or written, including step 3's initial\npatch and manifest, resolve the review artifact root and complete step 1's\ndirectory-ignore preflight, including accounting for an owned repair. Do not\ndefer this preflight until after saving the initial patch.\n\n1. Confirm workspace mode: `but status` must succeed (you are on a `gitbutler\u002F*`\n   workspace branch). If it fails with \"Setup required\" or similar, **stop and\n   tell the user to enter GitButler workspace mode first**.\n2. Enumerate the applied series bottom→top from JSON (`but status -j`); confirm\n   field names with `but status -h` before relying on them — do not guess.\n3. For each branch, resolve its current name, head SHA and parent SHA from\n   current GitButler metadata and verify those identities with Git. The parent\n   is the preceding series entry or the verified stack base; never guess trunk\n   or use the combined workspace HEAD. Refresh these identities after a prior\n   absorb. `but branch show \u003Cbranch>` is metadata, not a patch. Save the initial\n   parent\u002Fhead SHA diff and name-status manifest in this branch's `out_dir`;\n   reviewers read committed source with `git show \u003Chead_sha>:\u003Cpath>`. Run steps\n   1–11 using the stack-specific scope rules in step 2 below.\n4. After the loop converges clean and the project's check command has passed,\n   fold the fixes into that branch with `but absorb \u003Cbranch>` — run\n   `but absorb\n   \u003Cbranch> --dry-run` first and confirm it targets the intended\n   branch. If nothing was modified, skip.\n5. Same non-convergence rule: if a branch hits the 4-pass cap, stop on it — do\n   **NOT** advance to the next series. Report which branch is stuck.\n6. Publish checkpoints and remaining converged work according to\n   `GLOBAL_AGENTS.md`'s timing and managed-main workspace workflow, serialized\n   with the responsible workspace agent. Do not postpone a required checkpoint\n   until the entire walk finishes. Scoped fix commits do not authorize isolated\n   branch pushes. No mode changes, draft flips, new PRs or PR comments are\n   authorized by this skill. If a branch is stuck, report it; no checkout\n   restoration is needed.\n\nPer-branch summary:\n\n```\nStack review-loop summary:\n  branch-a: converged clean (fixed 3, amended)\n  branch-b: converged clean (no changes)\n  branch-c: stuck (4-pass cap — see above)\n```\n\n---\n\n## 1. Preflight\n\nVerify prerequisites before doing anything:\n\n1. You are in a git repo:\n   ```bash\n   git rev-parse --show-toplevel\n   ```\n\n   Single-branch mode works on any Git repository. Only `stack` mode needs\n   managed series; plain-Git worktrees run the single-branch loop.\n\n   Before the clean-tree gate or any artifact write, resolve the actual review\n   checkout root and apply `GLOBAL_AGENTS.md`'s directory-ignore preflight,\n   including state capture and separate repair accounting. Repeat it after\n   checkout transitions before using either temporary directory.\n\n2. For GitButler stack mode, confirm the tool is available in the authorized\n   project environment, but only after verifying a managed main worktree.\n\n3. The working tree is clean or stashed. A dirty tree pollutes the diff and\n   confuses reviewers:\n   ```bash\n   git status --porcelain\n   ```\n   If dirty, tell the user and stop.\n\nThe review engine uses native Pi `openai-codex\u002Fgpt-6.1-sol` lanes throughout. Do\nnot probe or launch external model CLIs, subscription wrappers or other\nproviders.\n\n## 2. Resolve scope & prepare workspace\n\nDetermine what to review. On a stacked branch, **always diff against its own\nparent, not trunk**; a trunk comparison would include ancestor PRs and drown\nthis branch's changes in unrelated scope.\n\n**Stack mode overrides the generic commands below.** Use the current virtual\nbranch's verified name, parent SHA and head SHA from the sequential adapter, not\nthe combined workspace branch or HEAD. Generate the initial diff and file\nmanifest from that immutable parent\u002Fhead range. Keep those review artifacts.\n\nBefore fixing that branch, record a clean tracked\u002Findex workspace baseline and\nserialize writers. Record each fix's exact paths and content changes, including\nagent-created new files. Only that recorded delta belongs to this fix pass;\ntiming or presence in the workspace alone does not establish ownership.\nUnexpected index, workspace, branch-head or base changes stop the pass.\n\nFor re-review, supply the committed branch patch plus its separately recorded\nowned fix delta, with committed source and the exact overlay changes. Do not\nregenerate branch evidence with `git diff \"$parent\"` against the combined\nworkspace, or concatenate two patches and call them one branch snapshot. If the\ndelta cannot be mapped to the selected branch without another branch's changes,\nstop before absorbing it and resolve the scope under existing authority. A\ncombined-workspace check is not proof of isolated branch validation.\n\nAfter convergence and required checks, inspect the targeted absorb dry-run.\nAbsorb only this branch's owned fixes; verify no owned delta remains and the\nworkspace is clean before advancing. Refresh descendant identities afterward.\n\n**Single-branch mode only:** the commands below resolve a plain-Git branch and\ninclude its uncommitted fixes. If the current checkout is a combined managed\nworkspace, do not treat it as one feature branch; resolve an explicit branch\nscope or use the stack adapter before proceeding.\n\nFor plain Git, use the merge-base with the verified default branch. In stack\nmode, override `parent` below with the exact parent from the adapter.\n\n```bash\ndefault_branch=$(git symbolic-ref refs\u002Fremotes\u002Forigin\u002FHEAD --short) || {\n  echo \"No verified default branch; resolve it before generating a review diff.\"\n  exit 1\n}\nparent=$(git merge-base \"$default_branch\" HEAD)\nbranch=$(git rev-parse --abbrev-ref HEAD)\nhead_sha=$(git rev-parse HEAD)\nparent_sha=$(git rev-parse \"$parent\")\nrepo_root=$(git rev-parse --show-toplevel) || exit 1\ninvocation_id=$(uuidgen) || exit 1\nsafe_branch=$(echo \"$branch\" | tr '\u002F' '_')\nout_dir=\"$repo_root\u002F.tmp\u002Fagent-local-ctx\u002Freviews\u002F${invocation_id}-${safe_branch}\"\n```\n\nResolve `repo_root` from the checkout actually being reviewed. For a linked\nreview worktree, run setup there and keep every patch, prompt, report, payload,\nand log under that worktree's `.tmp\u002F`, never the main checkout's `.tmp\u002F`. A\ncoordinator running elsewhere must pass the verified review-worktree root to\nworkflows and children; neither its own cwd nor the shared Git directory is an\nartifact root. Run the delta workflow from that checkout; a coordinator running\nelsewhere must add `cwd: repoRoot` to every child-agent options object in its\nexample. Set `repoRoot` to that verified checkout for every child cwd; never\nsubstitute `out_dir` or an exported `sourceRoot`. An exported source directory\nis a read boundary, not the review checkout. Remove these temporary artifacts\nwith the worktree.\n\nBefore creating the invocation directory or writing any artifact, complete step\n1's global preflight for this invocation path, including repair accounting\nbefore recording a clean fix baseline:\n\n```bash\ngit check-ignore --verbose \"$repo_root\u002F.tmp\u002F\" \"$out_dir\u002Fdiff.patch\"\n```\n\nThen call the registered `artifact_provenance` tool with the resolved absolute\nvalue of `out_dir`:\n\n```json\n{ \"action\": \"create_directory\", \"path\": \"\u003Cresolved absolute out_dir>\" }\n```\n\nRequire successful creation and provenance recording before writing descendants.\nUse an available registered harness equivalent if its tool name differs; do not\nfall back to raw `mkdir`. Add `crossWorkspace: true` only for an independently\nauthorized target outside the tool session's workspace. The native UUID supplies\nthe invocation namespace; the creation API does not promise exclusive\nallocation.\n\nWrite the diff and file manifest. Diff against the working tree (no `..HEAD`) so\nre-review iterations automatically include uncommitted fixes:\n\n```bash\ngit diff \"$parent\" > \"$out_dir\u002Fdiff.patch\"\ngit diff --name-status \"$parent\" > \"$out_dir\u002Ffiles.txt\"\nwc -l \"$out_dir\u002Fdiff.patch\"\n```\n\nRefuse to proceed if the diff is empty. Diff size is not an approval gate and\nmust not reduce review depth. For large diffs, follow review-core's bounded\nchunking and track complete retained-code and removal-boundary coverage. Inspect\ndeleted code only as needed to verify surviving behavior, compatibility and\nremoval effects; do not spend a review pass re-auditing intentional deletions.\nPreserve completed reviews and recover only missing chunks or context.\n\n## 3. Load project context\n\n```bash\nfind \"$repo_root\" -maxdepth 3 \\( -name \"CLAUDE.md\" -o -name \"AGENTS.md\" \\) \\\n  -not -path \"*\u002Fnode_modules\u002F*\" -not -path \"*\u002Ftarget\u002F*\"\n```\n\nKeep only the paths — they become `docsPaths` for the engine. Reviewers read\nthem themselves.\n\nAlso extract the PR description if a PR exists for this branch:\n\n```bash\npr_body=$(gh pr view --json body --jq '.body' 2>\u002Fdev\u002Fnull || echo \"No PR description available.\")\n```\n\nStrip bot-appended footers before embedding the description in prompts: cut\neverything from the first HTML-comment footer marker onward (e.g.\n`\u003C!--\ncodesmith:footer -->`, CodeRabbit\u002FCodesmith badges, tracking links).\nReviewers should see only the author-written description.\n\n### Discover the project's check command\n\nThe loop runs the project's own verification after it converges. This command is\n**project-specific and must be declared by the project**, never assumed by this\nskill — different repos check themselves in completely different ways, and\nhardcoding one repo's command (or a laptop-global wrapper) would couple this\nskill to a setup it shouldn't know about. Discover it, in order:\n\n1. An explicit declaration in the project's `CLAUDE.md` \u002F `AGENTS.md` (a\n   \"check\"\u002F\"CI\"\u002F\"verify\"\u002F\"build commands\" section naming the command to run).\n2. A task runner target the repo defines — `just check`, a `Makefile`\n   `check`\u002F`test` target, `package.json` scripts, `cargo`\u002F`nix` invocations the\n   docs point at.\n\nRecord the discovered command as `check_cmd` and use it everywhere this skill\nsays \"the project's check command\". **If the project declares no check command,\nset `check_cmd` to empty and skip every check step** (convergence is then\ndecided by the review passes alone) — do not invent one.\n\n### Prewarm the check shell (overlap setup with the panel) — rarely needed\n\n**Prefer the project's direnv-provided dev shell.** If the repo has an `.envrc`\n(`use flake` \u002F `use nix`), direnv has already loaded the default dev shell — the\ntools the check command needs are on `PATH` and the shell is warm. There is\n**nothing to prewarm**; skip this. Run commands through the active environment\n(or `direnv exec \"$repo_root\" \u003Ccmd>`), not a fresh `nix develop`.\n\nOnly reach for a manual `nix develop` when the check command needs a\n**non-default** shell that direnv does _not_ load (e.g. a `.#integration` \u002F\n`.#e2e` shell) and that shell is slow cold. Even then, read the **real**\ndevShell attr from the project's check command or `nix flake show`. **Never\ninvent an attr like `.#ci`**; if you can't name the shell, don't prewarm. Repos\nwith no Nix dev shell have nothing to warm — skip silently. On the rare occasion\nit applies:\n\n```bash\nnix develop .#\u003Creal-non-default-attr> -c true >\u002Fdev\u002Fnull 2>&1 &\n```\n\n## 4. Run the review engine\n\nAutomatically include power-unslop for every scoped `.md` file through the\nshared engine's Markdown lane, including a prose-only branch. Supply the full\nscoped Markdown set plus relevant controlling\u002Flinked docs; check logical\nconsistency across them, not only within individual files. Keep the critic\nread-only, apply valid repairs centrally under the existing fix authority, and\nre-review the updated set until complete. No extra opt-in or prose draft is\nrequired. Unread Markdown prevents a clean completion claim.\n\nRun the shared engine in `~\u002F.claude\u002Fskills\u002Freview-core\u002FSKILL.md` (steps 1–7:\navailable lanes → reviewer prompts → inspector prompts → the `review-panel`\nWorkflow → after-workflow handling → print findings). Pass the contract inputs:\n\n| Contract input                                          | Value for review-loop                                                                                                                                                                                                                                      |\n| ------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |\n| `out_dir`, `{DIFF_PATH}`, `{FILES_PATH}`, `{REPO_ROOT}` | from step 2 (`$out_dir\u002Fdiff.patch`, `$out_dir\u002Ffiles.txt`)                                                                                                                                                                                                  |\n| `{PROJECT_DOCS_PATHS}`                                  | the docs paths from step 3                                                                                                                                                                                                                                 |\n| `{PR_DESCRIPTION}`                                      | `pr_body` from step 3 (or \"No description available\")                                                                                                                                                                                                      |\n| `{SOURCE_ACCESS}`                                       | `Read source files directly from the working tree, which already reflects the change under review.`                                                                                                                                                        |\n| `{SCOPE_NOTE}`                                          | `The diff is scoped to exactly the changes under review (the current branch against its parent).`                                                                                                                                                          |\n| `{INSPECTOR_ARG}`                                       | empty string (the inspectors review the current branch)                                                                                                                                                                                                    |\n| `{REPORT_HEADER}`                                       | `# Review — \u003Cbranch>\\n**Commit:** \u003Chead_sha>\\n**Parent:** \u003Cparent_sha> (\u003Cparent branch>)\\n**Files changed:** \u003CN>\\n**Diff size:** \u003CLOC> lines\\n**Panel:** native gpt-6.1-sol focus lanes and applicable inspectors; independent verification and synthesis` |\n| `{TERMINAL_HEADER}`                                     | `Review — \u003Cbranch>\\n\u003CN> files, \u003CLOC> lines changed`                                                                                                                                                                                                        |\n| `{SYNTHESIS_EXTRA}`                                     | empty string                                                                                                                                                                                                                                               |\n| `{INCLUDE_ATTRIBUTION}`                                 | `true`                                                                                                                                                                                                                                                     |\n\n**Stack-mode contract override, for every initial, delta and escalated pass:**\n`{SOURCE_ACCESS}` names committed source at the selected branch head plus the\nexact owned overlay artifact, never the combined workspace as branch source.\n`{SCOPE_NOTE}` identifies the parent\u002Fhead range and the separately owned delta;\nheaders name those verified SHAs and distinguish combined-workspace checks from\nisolated branch checks. Supply both artifact paths to reviewers. Preserve the\ninitial patch rather than replacing it with a combined-workspace diff. Keep the\n`scriptPath` the workflow returns — re-review escalation (step 9) reuses it for\nlater full-panel passes. The engine writes `$out_dir\u002Freview.md` and\n`$out_dir\u002Ffindings.json` and prints the terminal summary; this skill triages the\nreturned `findings` array next.\n\nOnly a review result with `status: completed` and **no findings** is clean. If\nany required native reviewer, selected inspector, verifier or synthesis phase is\nincomplete, retain its evidence and exact reason, and continue the missing work\nunder existing authority. Empty findings from incomplete review are not success\nand do not end the loop.\n\n## 5. Triage input\n\nTriage works directly on the structured `findings` array returned by the engine\n(also saved to `findings.json`) — no report parsing. Each finding carries:\n`title`, `severity` (re-scored by the verifier), `verdict` (valid | likely |\ndisputed), `confidence` (re-scored), `category`, `file` +\n`line_start`\u002F`line_end`, `finding`, `recommended_fix`, and the verifier's\n`rationale`.\n\nFindings the verifier judged `invalid` or `out-of-scope` are already in the\nengine's `dismissed` list — never triage those.\n\n## 6. Build the triage plan\n\nFor each remaining finding, compute a **default action** based on severity,\nverdict, and confidence. **Bias heavily toward fixing now** — only defer when\nthe fix is massive enough to warrant its own stacked PR.\n\n**Error-contract boundary:** This boundary overrides severity defaults and every\nautomatic-fix instruction in this skill. Automatically correct error models only\nwhen the public error contract is preserved or that specific contract change is\nalready authorized. Otherwise classify the finding as **Discuss** before\nediting. Do not request renewed approval for an already-authorized correction.\n\n| Severity | Verdict  | Confidence | Default action   |\n| -------- | -------- | ---------- | ---------------- |\n| critical | any      | any        | **Auto-fix**     |\n| high     | valid    | >= 50      | **Auto-fix**     |\n| high     | likely   | >= 50      | **Auto-fix**     |\n| high     | disputed | any        | **Discuss**      |\n| medium   | valid    | >= 50      | **Auto-fix**     |\n| medium   | likely   | >= 50      | **Auto-fix**     |\n| medium   | disputed | any        | **Discuss**      |\n| low      | valid    | >= 75      | **Auto-fix**     |\n| low      | any      | \u003C 75       | **Auto-dismiss** |\n| nit      | any      | any        | **Auto-dismiss** |\n\nVerified violations of required code conventions are not personal-preference\nnits. Auto-fix bounded, behavior-preserving spacing\u002Fimport repairs and required\nidentifier\u002Ferror-model corrections after verifying the concrete finding, even\nwhen their severity is low. Do not auto-dismiss them merely as cosmetic. Keep\nreal ambiguity, meaningful error context, invariants and language requirements;\nre-test and re-review semantic changes. This does not expand publication scope.\n\n**Auto-fix**: apply the fix immediately without asking. No user input needed.\n\n**Auto-dismiss**: drop the finding silently. No user input needed.\n\n**Discuss**: the evidence is weak, reviewers disagree, or the specific public\nerror-contract change lacks authorization. Show the user the full finding and\nask what to do. Do not edit an unauthorized public error-contract change before\nauthorization.\n\n**Defer to GitHub** is NOT a default action. Only use it when:\n\n- The user explicitly asks to defer a specific finding, OR\n- A fix is large enough that it should be a separate stacked PR (e.g., a\n  multi-file refactor or new feature, not a surgical bug fix)\n\nWhen in doubt, fix it now.\n\n## 7. Present the plan and auto-apply\n\nPrint the plan as a table, in severity order:\n\n```\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nReview-loop triage — \u003CN> findings (iteration \u003CI>)\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n # | sev      | action       | title\n---+----------+--------------+------------------------\n 1 | critical | auto-fix     | Off-by-one in batch loop\n 2 | high     | auto-fix     | Missing auth check on \u002Fadmin\n 3 | medium   | auto-fix     | Add retry on transient errors\n 4 | medium   | DISCUSS      | Lock contention in hot path\n 5 | nit      | auto-dismiss | Rename variable for clarity\n\nFull details: \u003Cpath to review.md>\n```\n\n**Auto-fix and auto-dismiss findings proceed immediately — no user input.**\n\nFor **discuss** findings only, use `AskUserQuestion`:\n\n```\nQ: [#N] \u003Ctitle> — sev \u003Cseverity>. Decision needed — what should I do?\n   options:\n     - \"Fix now\" (Recommended) — implement the fix in this session\n     - \"Dismiss\" — drop it, not a real issue\n     - \"Defer\" — too large for this PR, will stack separately\n     - \"Show me the details\" — read the full finding first\n```\n\nIf the user picks \"Show me the details\", present the finding conversationally\nand re-ask without that option.\n\nAfter resolving discuss items, print the consolidated plan:\n\n```\nPlan:\n  Fix now (4):     #1, #2, #3, #4\n  Dismiss (1):     #5\n```\n\n## 8. Apply verified fixes centrally\n\nGroup findings by file or tightly coupled feature. Independent read-only agents\nmay verify current code and propose precise repairs in parallel; they must not\nedit the shared checkout or run mutating commands. Apply dependent source edits\ncentrally in the parent, preserving unrelated working-tree\u002Findex changes.\n\nFor each finding, re-read the current source and verify it still applies. Make\nthe smallest correct change, add required regression coverage, and record the\nowned delta. If the fix grows beyond its authorized scope, re-triage instead of\nsilently expanding it. Keep review-only callers read-only.\n\nSeparate mutating workers\u002Fworktrees require the independently owner-authorized\nconcurrency allowed by global policy; assigning disjoint files is not itself\npermission. Ordinary review-loop fan-out remains read-only.\n\n### Compile gate\n\nAfter **all** fix-now items are done (serial and fan-out merged), run the\n**compile gate** before any re-review: the project's fastest typecheck scoped to\nwhat was touched (for Rust, `cargo check -p \u003Ctouched crates>`; otherwise the\nproject's equivalent). Fix any compile errors immediately — never enter a\nre-review pass with code that doesn't compile; that wastes an entire pass. The\ncompile gate is NOT a substitute for the project's check command — full tests\nand lints still run only after convergence.\n\nThen proceed directly to step 9 (re-review).\n\n## 9. Re-review loop (delta + escalation)\n\nRe-review after every fix pass to catch issues introduced by the fixes. This is\nthe core of the automatic loop.\n\n**CRITICAL: The re-review is NOT optional.** After fixing findings, you MUST\nre-review at least once. Do not skip it because the fixes \"looked\nstraightforward.\" Only a review pass determines when the loop is done.\n\n**CRITICAL: Convergence requires a CLEAN review pass.** The loop is ONLY done\nwhen a review pass returns no new actionable findings. Fixing the last batch is\nNOT convergence. The pattern is always:\n`review → fix → review → fix → review(clean) →\ncheck → done`. You can never end\non a fix. The project's check command runs only after convergence, and if it\nmakes changes, you re-enter the loop.\n\n### Choose the re-review mode\n\n**Stack mode:** use the already recorded owned fix-delta artifact and immutable\nparent\u002Fhead patch from step 2. Export the scoped committed source to an\nagent-owned review directory for read-only reviewers; provide the owned overlay\nseparately. Do not execute the shell block below in stack mode. Unknown changes\nor unavailable branch-source\u002Foverlay evidence block re-review, not count as\nclean.\n\n**Single-branch mode only:** compute the uncommitted fix delta against HEAD:\n\n```bash\ngit diff HEAD > \"$out_dir\u002Fdelta-iter${N}.patch\"\ngit diff HEAD --stat | tail -1\ngit diff \"$parent\" > \"$out_dir\u002Fdiff-iter${N}.patch\"   # updated full diff\n```\n\n**Markdown re-review.** Any changed `.md` file requires a fresh power-unslop\npass over the current scoped Markdown set and relevant cross-document context,\neven when the code delta is small. Re-bind the review to current saved bytes.\nThis prose lane need not rerun unrelated code reviewers, but cannot be omitted\nfrom a clean result.\n\n**Formatter-only skip (non-Markdown).** If the only thing that changed since the\nlast reviewed state is the output of a deterministic formatter\u002Fhook\n(`cargo fmt`, `deno fmt`, `prettier`, `yamlfmt`, `nixfmt`) and that formatter\nnow passes, **do not spawn a review pass over it** — formatter output cannot\nintroduce a review-worthy finding. Confirm the delta matches what re-running the\nformatter produces; if any hand-written line changed, fall through to the normal\nmodes. Treat a pure-formatter delta as verified by construction and skip to\nconvergence. If Markdown changed, run the Markdown re-review above instead; do\nnot carry an old prose hash or cross-document verdict forward as if it covered\nthe new text.\n\n**Escalate to a full panel pass** (re-run the review engine — review-core steps\n1–7 — with the updated full diff, applying review-core's adaptive sizing; reuse\nthe workflow `scriptPath` from step 4) when any of:\n\n- the fix delta exceeds ~200 changed lines, OR\n- the fixes touched files that no fixed finding implicated (scope grew), OR\n- the fixes touched **security-sensitive paths** (auth, secrets,\n  payment\u002Ffinancial, on-chain, migrations) — a fresh independent pass is worth\n  the cost here even for a small delta.\n\n**Otherwise run delta mode** — the default and fast path. One small workflow: a\nfix-verifier per fixed finding plus one independent native broad sweep of the\nfix delta. Pass `args`:\n`{fixedFindings: \u003Cfindings fixed this loop so far>, deltaDiffPath,\nfullDiffPath, repoRoot, docsPaths, reviewSource, tierModels, markdownFiles,\nmarkdownPromptPath}`.\nAlways supply `markdownFiles` from the scoped manifest, including an explicit\nempty array when none exist. For a nonempty list, supply an existing Markdown\nprompt using power-unslop's whole-set contract. Never infer that a missing\nMarkdown result means there were no Markdown files. `tierModels` is retained for\ncompatibility; both fields name `openai-codex\u002Fgpt-6.1-sol`, and the workflow\npins that model rather than selecting by provider or tier. `reviewSource` must\ncontain `mode` (`single` or `stack`), `branch`, `parentSha`, `headSha`,\n`sourceRoot`, and `ownedDeltaPath`, all resolved from step 2. In stack mode\n`sourceRoot` is the exported committed branch source, never the combined\nworkspace; in single mode it is the current source root. Both modes name the\nexact owned delta artifact. Missing scope is blocked, not a clean review. Reuse\nthe returned `scriptPath` only with refreshed scope and artifact inputs on later\npasses.\n\n```javascript\nconst meta = {\n  name: \"review-delta\",\n  description: \"Verify applied fixes and sweep the fix delta for new issues\",\n  phases: [\n    { title: \"Verify fixes\", detail: \"one verifier per fixed finding\" },\n    { title: \"Sweep\", detail: \"broad review of the fix delta\" },\n  ],\n};\n\nconst FINDING = {\n  type: \"object\",\n  required: [\n    \"title\",\n    \"severity\",\n    \"file\",\n    \"line_start\",\n    \"line_end\",\n    \"category\",\n    \"finding\",\n    \"why_it_matters\",\n    \"recommended_fix\",\n    \"confidence\",\n  ],\n  properties: {\n    title: { type: \"string\" },\n    severity: { enum: [\"critical\", \"high\", \"medium\", \"low\", \"nit\"] },\n    file: { type: \"string\" },\n    line_start: { type: \"integer\" },\n    line_end: { type: \"integer\" },\n    category: {\n      enum: [\n        \"correctness\",\n        \"security\",\n        \"convention\",\n        \"maintainability\",\n        \"tests\",\n        \"doc-coherence\",\n      ],\n    },\n    finding: { type: \"string\" },\n    why_it_matters: { type: \"string\" },\n    recommended_fix: { type: \"string\" },\n    confidence: { type: \"integer\" },\n  },\n};\n\nconst VERIFY_FIX_SCHEMA = {\n  type: \"object\",\n  required: [\"fixed\", \"rationale\"],\n  properties: {\n    fixed: { type: \"boolean\" },\n    rationale: { type: \"string\" },\n    new_issues: { type: \"array\", items: FINDING },\n  },\n};\n\nconst SWEEP_SCHEMA = {\n  type: \"object\",\n  required: [\"findings\"],\n  properties: {\n    findings: { type: \"array\", items: FINDING },\n    clean_reason: { type: \"string\" },\n  },\n};\n\n\u002F\u002F The harness may deliver args as a JSON-encoded string instead of a\n\u002F\u002F parsed object — parse defensively before destructuring.\nconst parsedArgs = typeof args === \"string\" ? JSON.parse(args) : args;\nconst {\n  fixedFindings,\n  deltaDiffPath,\n  fullDiffPath,\n  repoRoot,\n  docsPaths,\n  reviewSource,\n  tierModels,\n  markdownFiles,\n  markdownPromptPath,\n} = parsedArgs;\n\u002F\u002F All native lanes use the current authenticated model.\nconst lightModel = \"openai-codex\u002Fgpt-6.1-sol\";\nconst scopeFields = [\n  \"branch\",\n  \"parentSha\",\n  \"headSha\",\n  \"sourceRoot\",\n  \"ownedDeltaPath\",\n];\nif (\n  !reviewSource || ![\"single\", \"stack\"].includes(reviewSource.mode) ||\n  scopeFields.some((key) =>\n    typeof reviewSource[key] !== \"string\" || !reviewSource[key].trim()\n  )\n) {\n  return {\n    status: \"blocked\",\n    reason: \"Missing explicit review source identity\",\n  };\n}\nconst sourceContext =\n  `Review source identity: ${JSON.stringify(reviewSource)}. ` +\n  `Read only the named sourceRoot plus ownedDeltaPath. In stack mode this is ` +\n  `committed branch source plus its owned overlay, never the combined workspace. `;\n\nif (\n  !Array.isArray(markdownFiles) ||\n  (markdownFiles.length > 0 &&\n    (typeof markdownPromptPath !== \"string\" || !markdownPromptPath.trim()))\n) {\n  return {\n    status: \"incomplete\",\n    phaseErrors: [\"Missing Markdown review scope\u002Fprompt\"],\n  };\n}\nconst markdownRequired = markdownFiles.length > 0;\nconst MARKDOWN_SCHEMA = {\n  type: \"object\",\n  required: [\"findings\", \"reviewedFiles\", \"unreadFiles\"],\n  properties: {\n    findings: { type: \"array\", items: FINDING },\n    reviewedFiles: { type: \"array\", items: { type: \"string\" } },\n    unreadFiles: { type: \"array\", items: { type: \"string\" } },\n  },\n};\n\nconst [verifications, sweep, markdown] = await parallel([\n  () =>\n    parallel(fixedFindings.map((finding) => () =>\n      agent(\n        sourceContext +\n          `A code review flagged this finding and a fix was applied:\\n` +\n          `${JSON.stringify(finding)}\\n\\n` +\n          `The fix delta (uncommitted changes) is at: ${deltaDiffPath}\\n` +\n          `The full PR diff (context) is at: ${fullDiffPath}\\n` +\n          `Repo root: ${repoRoot}\\n\\n` +\n          `Read the scoped source and owned overlay at the finding's location. Confirm the fix ` +\n          `fully resolves the finding — not partially, not by suppressing the ` +\n          `symptom — and check the surrounding code for issues the fix may ` +\n          `have introduced. Report new_issues only for problems caused by or ` +\n          `directly adjacent to the fix.`,\n        {\n          cwd: repoRoot,\n          label: `verify-fix:${finding.title}`,\n          phase: \"Verify fixes\",\n          model: lightModel,\n          schema: VERIFY_FIX_SCHEMA,\n        },\n      ).then((result) => result && ({ finding, ...result }))\n    )),\n  () =>\n    agent(\n      sourceContext +\n        `You are a senior staff engineer reviewing a set of fixes applied in ` +\n        `response to a code review. The fix delta is at: ${deltaDiffPath}. ` +\n        `The full PR diff (context) is at: ${fullDiffPath}. Project docs: ` +\n        `${docsPaths.join(\", \")}. Repo root: ${repoRoot}.\\n\\n` +\n        `Review the fix delta holistically: bugs, broken invariants, ` +\n        `interactions with the rest of the PR, convention violations from the ` +\n        `project docs. Apply the same bar as a full review — correctness ` +\n        `first; enforce required code conventions without inventing personal style ` +\n        `nits, and do not duplicate compiler or linter diagnostics. ` +\n        `Return findings, or an empty list with clean_reason if clean.`,\n      {\n        cwd: repoRoot,\n        label: \"delta-sweep\",\n        phase: \"Sweep\",\n        model: lightModel,\n        schema: SWEEP_SCHEMA,\n      },\n    ),\n  () =>\n    markdownRequired\n      ? agent(\n        sourceContext +\n          `Read ${markdownPromptPath} and the complete scoped Markdown set: ` +\n          `${\n            JSON.stringify(markdownFiles)\n          }. Be the independent power-unslop critic; ` +\n          `check cross-document logical consistency and relevant controlling\u002Flinked docs. ` +\n          `Do not edit or spawn another critic. Report reviewedFiles for scoped files ` +\n          `only and unreadFiles for any incomplete required coverage.`,\n        {\n          cwd: repoRoot,\n          label: \"markdown-consistency\",\n          phase: \"Sweep\",\n          model: lightModel,\n          tools: [\"read\"],\n          schema: MARKDOWN_SCHEMA,\n        },\n      )\n      : Promise.resolve({ findings: [], reviewedFiles: [], unreadFiles: [] }),\n]);\n\nconst phaseErrors = [];\nif (\n  !Array.isArray(verifications) || verifications.length !== fixedFindings.length\n) {\n  phaseErrors.push(\"Missing fix-verification results\");\n}\nfor (let index = 0; index \u003C fixedFindings.length; index++) {\n  const result = verifications?.[index];\n  if (\n    !result || result.status === \"blocked\" || typeof result.fixed !== \"boolean\"\n  ) {\n    phaseErrors.push(`Fix verifier ${index} did not complete`);\n  }\n}\nif (!sweep || sweep.status === \"blocked\" || !Array.isArray(sweep.findings)) {\n  phaseErrors.push(\"Sweep did not complete\");\n}\nconst reviewedMarkdown = new Set(markdown?.reviewedFiles ?? []);\nif (\n  !markdown || markdown.status === \"blocked\" ||\n  !Array.isArray(markdown.findings) || !Array.isArray(markdown.unreadFiles) ||\n  markdown.unreadFiles.length > 0 ||\n  markdownFiles.some((path) => !reviewedMarkdown.has(path)) ||\n  reviewedMarkdown.size !== new Set(markdownFiles).size\n) {\n  phaseErrors.push(\"Markdown review did not complete\");\n}\nreturn {\n  status: phaseErrors.length > 0 ? \"incomplete\" : \"completed\",\n  phaseErrors,\n  expectedVerifications: fixedFindings.length,\n  verifications: verifications ?? [],\n  sweepFindings: Array.isArray(sweep?.findings) ? sweep.findings : null,\n  markdownFindings: Array.isArray(markdown?.findings)\n    ? markdown.findings\n    : null,\n};\n```\n\n**Overlap the check command with an escalated full-panel pass.** A delta pass is\ncheap, so running the check command only after it converges is fine. But when\nthis iteration **escalated to a full panel** (slow), start the project's check\ncommand in the background as you fire the panel — they read the same working\ntree and don't interact — then gate convergence on both: panel clean **and** the\ncheck command green with no changes → converged; panel clean **and** the check\ncommand made only formatter changes → apply the formatter-only skip; panel not\nclean → discard the in-flight check result (it reruns at the next convergence).\nNever overlap the check command with a cheap delta pass — the wasted runs aren't\nworth it. (Skip entirely if the project declared no check command.)\n\n### Interpret the result\n\n1. Save the result to `$out_dir\u002Fdelta-iter${N}.json` (audit trail).\n2. **Clean pass** requires `status: completed`, no phase errors, exactly the\n   expected verifier count, every verification `fixed: true` with no\n   `new_issues`, and completed empty `sweepFindings` and `markdownFindings`.\n   Missing, blocked or malformed results are incomplete, never empty success.\n   The loop has converged. Run the project's check command (`check_cmd`) and let\n   it run until it passes or it needs the user. If the project declared **no**\n   check command (`check_cmd` empty), there is nothing to run, so skip straight\n   to step 10\u002F11. If the check command itself commits or amends on success, that\n   behavior is **overridden by this loop**: never amend in single-branch mode\n   (hard rule 4); in stack mode the stack flow amends once per branch after\n   convergence, so the check command must not amend separately.\n   - If the check command made **no code changes**: proceed to step 10\u002F11.\n   - If it **made code changes** (lint, formatting, auto-fixes): run one more\n     delta pass over the new delta. This converges quickly since those changes\n     are mechanical.\n3. **Not clean**: preserve phase errors and all unresolved findings\n   (`fixed: false`), new issues, sweep findings and Markdown findings. A failed\n   fix verification is not dismissed because the same finding appeared in an\n   earlier iteration. Deduplicate only equivalent current findings without\n   dropping their unresolved status; recover missing phases before claiming\n   convergence. Then continue triage and re-review under the existing scope.\n\n**Cap at 4 review passes total** (full or delta — initial + up to 3 re-reviews).\nIf new findings keep appearing after 4 passes, stop and tell the user — the\nfixes are likely introducing as many issues as they solve, and a human needs to\nassess.\n\nPrint a status line at the start of each iteration:\n\n```\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nRe-review iteration \u003CN> (\u003Cdelta|full panel>) — checking for new issues\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n```\n\nWhen an escalated full pass re-runs the engine, treat any external pool that\nerrored earlier in this invocation as exhausted and re-resolve the lane\nassignment **without re-probing** it.\n\n## 10. Defer-to-GitHub loop (only if user explicitly deferred findings)\n\nThis step only runs if the user chose \"Defer\" for any discuss finding. Skip\nentirely if no findings were deferred.\n\nEvery deferred review finding requires exact per-issue approval. Routine\nplanning has separate authority and public-content checks; this skill grants no\nplanning-issue creation authority.\n\nFor each deferred finding:\n\n1. **Draft the issue** in the repository's approved `.tmp\u002F` area and record\n   artifact provenance. Follow the repository's issue template and\n   public-content rules; never copy private correspondence or internal logs into\n   the draft.\n   - **Title:** describe the concrete problem in the repository's issue style.\n   - **Body** (in the tempfile):\n\n     ```markdown\n     ## Problem\n\n     \u003Cissue text from the finding>\n\n     ## Evidence\n\n     - File: `\u003Cpath>:\u003Cline-range>`\n     - Finding category: \u003Ccorrectness | security | convention | ...>\n     - Severity: \u003Cseverity>\n     - Found during review of branch `\u003Cbranch>` (commit `\u003Csha>`)\n\n     ## Verification rationale\n\n     \u003Cpublic-safe summary of the verifier's rationale; no private context>\n\n     ---\n\n     \u003Cverified public PR or commit link, when available>\n     ```\n\n2. **Choose only verified metadata.** Use labels that exist in the repository\n   and match its conventions. GitHub issues have no universal CLI priority\n   field; do not invent priority flags or infer an assignee's availability.\n\n3. **Show the exact draft to the user** before creating the issue. Format:\n\n   ```\n   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n   Draft GitHub issue — [#N] \u003Cfinding title>\n   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n   Title:    \u003Cdraft title>\n   Severity: \u003Cfinding severity, not a GitHub priority field>\n   Labels:   \u003Clabels>\n\n   \u003Cbody contents>\n   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n   ```\n\n4. **Ask for confirmation**, using `AskUserQuestion`:\n\n   ```\n   Q: Create this GitHub issue for finding #N?\n     options:\n       - \"Create\"    (Recommended)\n       - \"Edit\"      — tell me what to change\n       - \"Skip\"      — don't create this one\n   ```\n\n   If the user picks \"Edit\", ask what to change, revise, and re-confirm.\n\n5. **Create the issue** only after explicit confirmation:\n\n   Use the exact approved file with\n   `gh issue create --repo \u003Cowner\u002Frepo>\n--title \u003Capproved-title> --body-file \u003Capproved-file>`,\n   adding only approved metadata. Inspect CLI help before unfamiliar flags.\n   Reuse an existing exact approval instead of asking the same question again.\n\n6. **Verify and record the returned issue URL\u002Fnumber** for the summary and\n   associated local task. Retain the draft when creation fails or the outcome is\n   uncertain; reconcile remote state before retries to avoid duplicates. Clean\n   only the exact agent-created draft after successful verification.\n\nYou can batch the confirmation step: if there are multiple \"defer\" findings,\ndraft all of them first, show all drafts, ask in one `AskUserQuestion` call (up\nto 4 at a time). Don't skip showing the drafts — the user must see the title and\nbody before any issue is created.\n\n## 11. Summarize\n\nAfter all review iterations converge (no new findings) and any deferred GitHub\nissues are created (or skipped), print a final summary:\n\n```\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nReview loop complete — \u003CN> iteration(s), converged clean\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\nFixed (3):\n  #1  critical  Off-by-one in batch loop               \u003Cfile>:\u003Cline>\n  #2  high      Missing auth check on \u002Fadmin            \u003Cfile>:\u003Cline>\n  #4  medium    Lock contention in hot path             \u003Cfile>:\u003Cline>\n\nDeferred to GitHub (1):\n  #3  medium    Add retry on transient errors           \u003CGitHub issue URL>\n\nDismissed (1):\n  #5  nit       Rename variable for clarity\n\nReports: \u003Cpaths to review.md and delta-iter*.json>\n```\n\nIn single-branch mode, follow the repository's publication rules; this skill\nalone does not authorize an amend, commit, or push.\n\n**In stack mode**, this is where the single-branch loop returns to the Stack\nflow: the GitButler wrapper, only in a verified managed main worktree, absorbs\nfixes with `but absorb` and advances through the series. Plain-Git and linked\nworktrees remain in single-branch mode. Print the per-branch summary line, then\ncontinue the upstack walk — do not stop here. Follow the global checkpoint\ncadence while advancing and publish any remaining work at the end; stack mode\ndoes not impose an end-only publication gate.\n\n---\n\n## Failure modes\n\n- **A required native lane errors:** retain incomplete status and its reason;\n  selected inspectors are required. Follow review-core's missing-work recovery.\n- **Review returns no findings:** review-core full-panel results require\n  `status: completed` for a clean success. Step 9 delta results use that step's\n  verification and sweep convergence criteria instead. Missing required evidence\n  remains incomplete; an empty findings list alone is not success.\n- **A fix turns out to be larger than expected:** stop, report progress, ask\n  whether to continue, defer to a stacked PR, or dismiss.\n- **Review pass cap hit (4 passes):** stop and tell the user. Summarize what was\n  fixed in each iteration and what new issues keep appearing.\n- **The workflow itself fails mid-run:** relaunch with\n  `{scriptPath, args,\n  resumeFromRunId}` — completed lanes return cached\n  results instantly; only the failed part re-runs.\n- **A GitHub issue fails to create:** report the exact `gh` error, leave the\n  draft tempfile in place, and continue with the rest of the deferred items. Ask\n  the user whether to retry the failed one at the end.\n- **The user says \"stop\" mid-loop:** immediately stop, then print the summary\n  with what was completed so far. Do not silently abandon the rest.\n\n## Hard rules\n\n1. **Auto-fix without asking** for findings that match auto-fix criteria. Only\n   ask the user about \"discuss\" findings.\n2. **Bias toward fixing now.** Defer to GitHub only when the user explicitly\n   asks or the fix is too large for the current PR.\n3. Never create GitHub issues for deferred review findings without explicit\n   per-issue user confirmation of the exact draft content.\n4. **Single-branch mode:** never amend, commit, or push — leave the fixes\n   uncommitted for the user to review unless repository policy independently\n   authorizes publication. **Stack mode, only in a verified GitButler-managed\n   main worktree:** `but absorb` into each branch is expected; checkpoint timing\n   and publication scope follow `GLOBAL_AGENTS.md`'s managed-main workspace\n   workflow, not an end-only or selected-branch push. Linked and other plain-Git\n   worktrees remain in single-branch mode. The fixes must reach the PRs. This\n   skill alone does not authorize draft→ready changes, new PRs, PR comments or\n   branch-protection overrides.\n5. Use `gh issue create --body-file` with the approved body file, not inline\n   escaped Markdown.\n6. Always re-verify findings against the current source before applying fixes —\n   the code may have changed since the review.\n7. Keep fixes surgical. No \"while I'm here\" cleanups.\n8. Parallelize independent read-only verification\u002Fproposals; apply source edits\n   centrally. Disjoint files do not authorize parallel writers. Any separately\n   authorized concurrent worker follows global ownership\u002Fworktree policy.\n9. Run the compile gate after every fix pass; run the project's check command\n   (`check_cmd`, or skip if none) only after the review loop converges clean. If\n   it makes code changes, run another delta pass.\n10. Cap at 4 review passes (full or delta). Convergence requires a clean pass —\n    never end on a fix. Stop and ask the user if you don't converge.\n11. The review pass runs as a single `Workflow` invocation (review-core), using\n    read-only native `openai-codex\u002Fgpt-6.1-sol` lanes. Do not launch external\n    model CLIs. Verification and synthesis happen inside the workflow, never in\n    the main session.\n12. Delta mode is only valid when the fix delta is small (~200 lines) and\n    confined to files implicated by fixed findings — otherwise escalate to a\n    full panel pass.\n13. Complete steps 1–2's global preflight and registered invocation-directory\n    creation before artifact writes; recheck after checkout transitions.\n","Run a full self-review loop on the current branch: review → auto-fix → CI →\nre-review → repeat until clean. Use this right before you push something you\nwrote yourself, to catch issues before reviewers do.\n\nThe **review engine** (panel, probes, prompts, the `review-panel` Workflow,\nfinding output) is shared with `\u002Freview-pr` and `\u002Freview-sweep` and lives in\n`~\u002F.claude\u002Fskills\u002Freview-core\u002FSKILL.md`. This skill **scopes the diff to the\ncurrent branch** and, after the engine returns findings, **takes the fix-loop\naction**: triage → fix → re-review until clean. Read `review-core` when a step\nsays \"run the review engine\".\n\nThe loop is **automatic by default**. Findings that clearly should be fixed are\nfixed without asking. The loop re-reviews after each fix pass to catch issues\nintroduced by the fixes themselves. It stops when a review pass returns no new\nactionable findings.\n\n**Speed design:** the **first pass** runs the native review panel, **adaptively\nsized to the diff** (small diffs run fewer lanes). Each finding is adversarially\nverified **before** triage so false positives never cost a fix-and-re-review\ncycle. Independent verification and repair proposals may run in read-only\nparallel lanes; the parent applies source edits centrally. A **compile gate**\nruns after each fix pass so a broken fix never burns a review pass, and a\n**formatter-only delta** is treated as verified by construction and skips the\npass entirely. **Re-review passes** run in fast delta mode (per-fix verifiers\nplus one broad sweep of the fix delta) and **escalate to a full independent\npanel pass** when the fix delta is large, scope grew, or it touched\nsecurity-sensitive paths. On an escalated full pass, the project's check command\noverlaps the panel concurrently.\n\n**Argument:** with no argument, the loop runs on the **current branch only**;\npublication requires independent repository or owner authority. With `stack`, it\nwalks every branch in the applied GitButler series sequentially, bottom to top,\nabsorbing each branch's verified fixes (see **Stack mode** below).\n\nFollow these steps precisely.\n\n---\n\n## Stack mode (`\u002Freview-loop stack`)\n\nWhen invoked with the `stack` argument, wrap the single-branch loop (steps 1–11)\nin an upstack walk: review-loop a branch, fold the fixes into its commit,\nadvance to the next branch, and repeat to the top of the stack. Passing `stack`\nis an explicit opt-in to the amend-and-advance flow, so in stack mode **hard\nrule #4 is relaxed**: you MAY absorb fixes into the current branch before\nadvancing (`but absorb`). Checkpoint timing and publication scope follow\n`GLOBAL_AGENTS.md`'s workspace workflow throughout the walk; final convergence\ndoes not defer an otherwise-required checkpoint. This skill alone does not\nauthorize draft→ready changes, new PRs or PR comments.\n\nWith no `stack` argument, skip this section entirely and run steps 1–11 once on\nthe current branch.\n\n### Detect the stacking tool\n\nUse GitButler in verified managed main worktrees and plain Git elsewhere. Follow\nthe mandatory whole-workspace publication rule in `GLOBAL_AGENTS.md`;\nrepository-local defaults do not override it. Detect topology before selecting\nstack mode (same detection as `\u002Freview-sweep`):\n\n```bash\nrepo_root=$(git rev-parse --show-toplevel)\ngit_common_dir=$(git rev-parse --path-format=absolute --git-common-dir)\nmain_root=$(git worktree list --porcelain | sed -n 's\u002F^worktree \u002F\u002Fp' | head -n1)\nif [ \"$repo_root\" != \"$main_root\" ]; then tool=none\nelif [ -d \"$git_common_dir\u002Fgitbutler\" ]; then\n  current_branch=$(git symbolic-ref --quiet --short HEAD) || {\n    echo \"Cannot establish the current branch; stop before choosing a workflow.\"\n    exit 1\n  }\n  case \"$current_branch\" in\n    gitbutler\u002F*) tool=gitbutler ;;\n    *) tool=none ;;\n  esac\nelse tool=none\nfi\necho \"stacking tool: $tool\"\n```\n\nGitButler is main-worktree-only: a linked, isolated, or scratch worktree routes\nto plain Git without probing `but`, even when its common Git directory belongs\nto a GitButler-managed main workspace.\n\n**`tool=none` (plain git):** there is no stack to walk. Tell the user this repo\nhas no stacking tool, run steps 1–11 once on the current branch (the normal\nsingle-branch loop), and stop — do not amend or advance.\n\nThe rest of this section branches on `$tool`. Each branch gets its own review\ndirectory (the step-2 `out_dir` is branch-named), its own diff against its own\nparent, and its own 4-pass cap. The Defer-to-GitHub step (10) still applies per\nbranch.\n\n### Stack adapter\n\n| Adapter operation          | GitButler managed main worktree                                                    |\n| -------------------------- | ---------------------------------------------------------------------------------- |\n| ready check                | verified main worktree on a `gitbutler\u002F*` workspace branch (`but status` succeeds) |\n| advance to next branch     | none — virtual branches are applied together                                       |\n| scope one branch's diff    | Git diff between verified parent\u002Fhead SHAs                                         |\n| absorb fixes into a branch | `but absorb \u003Cbranch>` (`--dry-run` first)                                          |\n| return to start            | none                                                                               |\n\n`but` is provided by the repo's flake\u002Fdevenv — if it is not on `PATH`, invoke it\nas `direnv exec \"$repo_root\" but …` for every `but` call. Never run `but setup`\n\u002F `but teardown` or otherwise change GitButler mode yourself.\n\n### Stack flow — [GitButler]\n\nAll virtual branches are applied at once, so there is no checkout\u002Fadvance — you\niterate the applied series in place.\n\nBefore any stack artifact is created or written, including step 3's initial\npatch and manifest, resolve the review artifact root and complete step 1's\ndirectory-ignore preflight, including accounting for an owned repair. Do not\ndefer this preflight until after saving the initial patch.\n\n1. Confirm workspace mode: `but status` must succeed (you are on a `gitbutler\u002F*`\n   workspace branch). If it fails with \"Setup required\" or similar, **stop and\n   tell the user to enter GitButler workspace mode first**.\n2. Enumerate the applied series bottom→top from JSON (`but status -j`); confirm\n   field names with `but status -h` before relying on them — do not guess.\n3. For each branch, resolve its current name, head SHA and parent SHA from\n   current GitButler metadata and verify those identities with Git. The parent\n   is the preceding series entry or the verified stack base; never guess trunk\n   or use the combined workspace HEAD. Refresh these identities after a prior\n   absorb. `but branch show \u003Cbranch>` is metadata, not a patch. Save the initial\n   parent\u002Fhead SHA diff and name-status manifest in this branch's `out_dir`;\n   reviewers read committed source with `git show \u003Chead_sha>:\u003Cpath>`. Run steps\n   1–11 using the stack-specific scope rules in step 2 below.\n4. After the loop converges clean and the project's check command has passed,\n   fold the fixes into that branch with `but absorb \u003Cbranch>` — run\n   `but absorb\n   \u003Cbranch> --dry-run` first and confirm it targets the intended\n   branch. If nothing was modified, skip.\n5. Same non-convergence rule: if a branch hits the 4-pass cap, stop on it — do\n   **NOT** advance to the next series. Report which branch is stuck.\n6. Publish checkpoints and remaining converged work according to\n   `GLOBAL_AGENTS.md`'s timing and managed-main workspace workflow, serialized\n   with the responsible workspace agent. Do not postpone a required checkpoint\n   until the entire walk finishes. Scoped fix commits do not authorize isolated\n   branch pushes. No mode changes, draft flips, new PRs or PR comments are\n   authorized by this skill. If a branch is stuck, report it; no checkout\n   restoration is needed.\n\nPer-branch summary:\n\n```\nStack review-loop summary:\n  branch-a: converged clean (fixed 3, amended)\n  branch-b: converged clean (no changes)\n  branch-c: stuck (4-pass cap — see above)\n```\n\n---\n\n## 1. Preflight\n\nVerify prerequisites before doing anything:\n\n1. You are in a git repo:\n   ```bash\n   git rev-parse --show-toplevel\n   ```\n\n   Single-branch mode works on any Git repository. Only `stack` mode needs\n   managed series; plain-Git worktrees run the single-branch loop.\n\n   Before the clean-tree gate or any artifact write, resolve the actual review\n   checkout root and apply `GLOBAL_AGENTS.md`'s directory-ignore preflight,\n   including state capture and separate repair accounting. Repeat it after\n   checkout transitions before using either temporary directory.\n\n2. For GitButler stack mode, confirm the tool is available in the authorized\n   project environment, but only after verifying a managed main worktree.\n\n3. The working tree is clean or stashed. A dirty tree pollutes the diff and\n   confuses reviewers:\n   ```bash\n   git status --porcelain\n   ```\n   If dirty, tell the user and stop.\n\nThe review engine uses native Pi `openai-codex\u002Fgpt-6.1-sol` lanes throughout. Do\nnot probe or launch external model CLIs, subscription wrappers or other\nproviders.\n\n## 2. Resolve scope & prepare workspace\n\nDetermine what to review. On a stacked branch, **always diff against its own\nparent, not trunk**; a trunk comparison would include ancestor PRs and drown\nthis branch's changes in unrelated scope.\n\n**Stack mode overrides the generic commands below.** Use the current virtual\nbranch's verified name, parent SHA and head SHA from the sequential adapter, not\nthe combined workspace branch or HEAD. Generate the initial diff and file\nmanifest from that immutable parent\u002Fhead range. Keep those review artifacts.\n\nBefore fixing that branch, record a clean tracked\u002Findex workspace baseline and\nserialize writers. Record each fix's exact paths and content changes, including\nagent-created new files. Only that recorded delta belongs to this fix pass;\ntiming or presence in the workspace alone does not establish ownership.\nUnexpected index, workspace, branch-head or base changes stop the pass.\n\nFor re-review, supply the committed branch patch plus its separately recorded\nowned fix delta, with committed source and the exact overlay changes. Do not\nregenerate branch evidence with `git diff \"$parent\"` against the combined\nworkspace, or concatenate two patches and call them one branch snapshot. If the\ndelta cannot be mapped to the selected branch without another branch's changes,\nstop before absorbing it and resolve the scope under existing authority. A\ncombined-workspace check is not proof of isolated branch validation.\n\nAfter convergence and required checks, inspect the targeted absorb dry-run.\nAbsorb only this branch's owned fixes; verify no owned delta remains and the\nworkspace is clean before advancing. Refresh descendant identities afterward.\n\n**Single-branch mode only:** the commands below resolve a plain-Git branch and\ninclude its uncommitted fixes. If the current checkout is a combined managed\nworkspace, do not treat it as one feature branch; resolve an explicit branch\nscope or use the stack adapter before proceeding.\n\nFor plain Git, use the merge-base with the verified default branch. In stack\nmode, override `parent` below with the exact parent from the adapter.\n\n```bash\ndefault_branch=$(git symbolic-ref refs\u002Fremotes\u002Forigin\u002FHEAD --short) || {\n  echo \"No verified default branch; resolve it before generating a review diff.\"\n  exit 1\n}\nparent=$(git merge-base \"$default_branch\" HEAD)\nbranch=$(git rev-parse --abbrev-ref HEAD)\nhead_sha=$(git rev-parse HEAD)\nparent_sha=$(git rev-parse \"$parent\")\nrepo_root=$(git rev-parse --show-toplevel) || exit 1\ninvocation_id=$(uuidgen) || exit 1\nsafe_branch=$(echo \"$branch\" | tr '\u002F' '_')\nout_dir=\"$repo_root\u002F.tmp\u002Fagent-local-ctx\u002Freviews\u002F${invocation_id}-${safe_branch}\"\n```\n\nResolve `repo_root` from the checkout actually being reviewed. For a linked\nreview worktree, run setup there and keep every patch, prompt, report, payload,\nand log under that worktree's `.tmp\u002F`, never the main checkout's `.tmp\u002F`. A\ncoordinator running elsewhere must pass the verified review-worktree root to\nworkflows and children; neither its own cwd nor the shared Git directory is an\nartifact root. Run the delta workflow from that checkout; a coordinator running\nelsewhere must add `cwd: repoRoot` to every child-agent options object in its\nexample. Set `repoRoot` to that verified checkout for every child cwd; never\nsubstitute `out_dir` or an exported `sourceRoot`. An exported source directory\nis a read boundary, not the review checkout. Remove these temporary artifacts\nwith the worktree.\n\nBefore creating the invocation directory or writing any artifact, complete step\n1's global preflight for this invocation path, including repair accounting\nbefore recording a clean fix baseline:\n\n```bash\ngit check-ignore --verbose \"$repo_root\u002F.tmp\u002F\" \"$out_dir\u002Fdiff.patch\"\n```\n\nThen call the registered `artifact_provenance` tool with the resolved absolute\nvalue of `out_dir`:\n\n```json\n{ \"action\": \"create_directory\", \"path\": \"\u003Cresolved absolute out_dir>\" }\n```\n\nRequire successful creation and provenance recording before writing descendants.\nUse an available registered harness equivalent if its tool name differs; do not\nfall back to raw `mkdir`. Add `crossWorkspace: true` only for an independently\nauthorized target outside the tool session's workspace. The native UUID supplies\nthe invocation namespace; the creation API does not promise exclusive\nallocation.\n\nWrite the diff and file manifest. Diff against the working tree (no `..HEAD`) so\nre-review iterations automatically include uncommitted fixes:\n\n```bash\ngit diff \"$parent\" > \"$out_dir\u002Fdiff.patch\"\ngit diff --name-status \"$parent\" > \"$out_dir\u002Ffiles.txt\"\nwc -l \"$out_dir\u002Fdiff.patch\"\n```\n\nRefuse to proceed if the diff is empty. Diff size is not an approval gate and\nmust not reduce review depth. For large diffs, follow review-core's bounded\nchunking and track complete retained-code and removal-boundary coverage. Inspect\ndeleted code only as needed to verify surviving behavior, compatibility and\nremoval effects; do not spend a review pass re-auditing intentional deletions.\nPreserve completed reviews and recover only missing chunks or context.\n\n## 3. Load project context\n\n```bash\nfind \"$repo_root\" -maxdepth 3 \\( -name \"CLAUDE.md\" -o -name \"AGENTS.md\" \\) \\\n  -not -path \"*\u002Fnode_modules\u002F*\" -not -path \"*\u002Ftarget\u002F*\"\n```\n\nKeep only the paths — they become `docsPaths` for the engine. Reviewers read\nthem themselves.\n\nAlso extract the PR description if a PR exists for this branch:\n\n```bash\npr_body=$(gh pr view --json body --jq '.body' 2>\u002Fdev\u002Fnull || echo \"No PR description available.\")\n```\n\nStrip bot-appended footers before embedding the description in prompts: cut\neverything from the first HTML-comment footer marker onward (e.g.\n`\u003C!--\ncodesmith:footer -->`, CodeRabbit\u002FCodesmith badges, tracking links).\nReviewers should see only the author-written description.\n\n### Discover the project's check command\n\nThe loop runs the project's own verification after it converges. This command is\n**project-specific and must be declared by the project**, never assumed by this\nskill — different repos check themselves in completely different ways, and\nhardcoding one repo's command (or a laptop-global wrapper) would couple this\nskill to a setup it shouldn't know about. Discover it, in order:\n\n1. An explicit declaration in the project's `CLAUDE.md` \u002F `AGENTS.md` (a\n   \"check\"\u002F\"CI\"\u002F\"verify\"\u002F\"build commands\" section naming the command to run).\n2. A task runner target the repo defines — `just check`, a `Makefile`\n   `check`\u002F`test` target, `package.json` scripts, `cargo`\u002F`nix` invocations the\n   docs point at.\n\nRecord the discovered command as `check_cmd` and use it everywhere this skill\nsays \"the project's check command\". **If the project declares no check command,\nset `check_cmd` to empty and skip every check step** (convergence is then\ndecided by the review passes alone) — do not invent one.\n\n### Prewarm the check shell (overlap setup with the panel) — rarely needed\n\n**Prefer the project's direnv-provided dev shell.** If the repo has an `.envrc`\n(`use flake` \u002F `use nix`), direnv has already loaded the default dev shell — the\ntools the check command needs are on `PATH` and the shell is warm. There is\n**nothing to prewarm**; skip this. Run commands through the active environment\n(or `direnv exec \"$repo_root\" \u003Ccmd>`), not a fresh `nix develop`.\n\nOnly reach for a manual `nix develop` when the check command needs a\n**non-default** shell that direnv does _not_ load (e.g. a `.#integration` \u002F\n`.#e2e` shell) and that shell is slow cold. Even then, read the **real**\ndevShell attr from the project's check command or `nix flake show`. **Never\ninvent an attr like `.#ci`**; if you can't name the shell, don't prewarm. Repos\nwith no Nix dev shell have nothing to warm — skip silently. On the rare occasion\nit applies:\n\n```bash\nnix develop .#\u003Creal-non-default-attr> -c true >\u002Fdev\u002Fnull 2>&1 &\n```\n\n## 4. Run the review engine\n\nAutomatically include power-unslop for every scoped `.md` file through the\nshared engine's Markdown lane, including a prose-only branch. Supply the full\nscoped Markdown set plus relevant controlling\u002Flinked docs; check logical\nconsistency across them, not only within individual files. Keep the critic\nread-only, apply valid repairs centrally under the existing fix authority, and\nre-review the updated set until complete. No extra opt-in or prose draft is\nrequired. Unread Markdown prevents a clean completion claim.\n\nRun the shared engine in `~\u002F.claude\u002Fskills\u002Freview-core\u002FSKILL.md` (steps 1–7:\navailable lanes → reviewer prompts → inspector prompts → the `review-panel`\nWorkflow → after-workflow handling → print findings). Pass the contract inputs:\n\n| Contract input                                          | Value for review-loop                                                                                                                                                                                                                                      |\n| ------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |\n| `out_dir`, `{DIFF_PATH}`, `{FILES_PATH}`, `{REPO_ROOT}` | from step 2 (`$out_dir\u002Fdiff.patch`, `$out_dir\u002Ffiles.txt`)                                                                                                                                                                                                  |\n| `{PROJECT_DOCS_PATHS}`                                  | the docs paths from step 3                                                                                                                                                                                                                                 |\n| `{PR_DESCRIPTION}`                                      | `pr_body` from step 3 (or \"No description available\")                                                                                                                                                                                                      |\n| `{SOURCE_ACCESS}`                                       | `Read source files directly from the working tree, which already reflects the change under review.`                                                                                                                                                        |\n| `{SCOPE_NOTE}`                                          | `The diff is scoped to exactly the changes under review (the current branch against its parent).`                                                                                                                                                          |\n| `{INSPECTOR_ARG}`                                       | empty string (the inspectors review the current branch)                                                                                                                                                                                                    |\n| `{REPORT_HEADER}`                                       | `# Review — \u003Cbranch>\\n**Commit:** \u003Chead_sha>\\n**Parent:** \u003Cparent_sha> (\u003Cparent branch>)\\n**Files changed:** \u003CN>\\n**Diff size:** \u003CLOC> lines\\n**Panel:** native gpt-6.1-sol focus lanes and applicable inspectors; independent verification and synthesis` |\n| `{TERMINAL_HEADER}`                                     | `Review — \u003Cbranch>\\n\u003CN> files, \u003CLOC> lines changed`                                                                                                                                                                                                        |\n| `{SYNTHESIS_EXTRA}`                                     | empty string                                                                                                                                                                                                                                               |\n| `{INCLUDE_ATTRIBUTION}`                                 | `true`                                                                                                                                                                                                                                                     |\n\n**Stack-mode contract override, for every initial, delta and escalated pass:**\n`{SOURCE_ACCESS}` names committed source at the selected branch head plus the\nexact owned overlay artifact, never the combined workspace as branch source.\n`{SCOPE_NOTE}` identifies the parent\u002Fhead range and the separately owned delta;\nheaders name those verified SHAs and distinguish combined-workspace checks from\nisolated branch checks. Supply both artifact paths to reviewers. Preserve the\ninitial patch rather than replacing it with a combined-workspace diff. Keep the\n`scriptPath` the workflow returns — re-review escalation (step 9) reuses it for\nlater full-panel passes. The engine writes `$out_dir\u002Freview.md` and\n`$out_dir\u002Ffindings.json` and prints the terminal summary; this skill triages the\nreturned `findings` array next.\n\nOnly a review result with `status: completed` and **no findings** is clean. If\nany required native reviewer, selected inspector, verifier or synthesis phase is\nincomplete, retain its evidence and exact reason, and continue the missing work\nunder existing authority. Empty findings from incomplete review are not success\nand do not end the loop.\n\n## 5. Triage input\n\nTriage works directly on the structured `findings` array returned by the engine\n(also saved to `findings.json`) — no report parsing. Each finding carries:\n`title`, `severity` (re-scored by the verifier), `verdict` (valid | likely |\ndisputed), `confidence` (re-scored), `category`, `file` +\n`line_start`\u002F`line_end`, `finding`, `recommended_fix`, and the verifier's\n`rationale`.\n\nFindings the verifier judged `invalid` or `out-of-scope` are already in the\nengine's `dismissed` list — never triage those.\n\n## 6. Build the triage plan\n\nFor each remaining finding, compute a **default action** based on severity,\nverdict, and confidence. **Bias heavily toward fixing now** — only defer when\nthe fix is massive enough to warrant its own stacked PR.\n\n**Error-contract boundary:** This boundary overrides severity defaults and every\nautomatic-fix instruction in this skill. Automatically correct error models only\nwhen the public error contract is preserved or that specific contract change is\nalready authorized. Otherwise classify the finding as **Discuss** before\nediting. Do not request renewed approval for an already-authorized correction.\n\n| Severity | Verdict  | Confidence | Default action   |\n| -------- | -------- | ---------- | ---------------- |\n| critical | any      | any        | **Auto-fix**     |\n| high     | valid    | >= 50      | **Auto-fix**     |\n| high     | likely   | >= 50      | **Auto-fix**     |\n| high     | disputed | any        | **Discuss**      |\n| medium   | valid    | >= 50      | **Auto-fix**     |\n| medium   | likely   | >= 50      | **Auto-fix**     |\n| medium   | disputed | any        | **Discuss**      |\n| low      | valid    | >= 75      | **Auto-fix**     |\n| low      | any      | \u003C 75       | **Auto-dismiss** |\n| nit      | any      | any        | **Auto-dismiss** |\n\nVerified violations of required code conventions are not personal-preference\nnits. Auto-fix bounded, behavior-preserving spacing\u002Fimport repairs and required\nidentifier\u002Ferror-model corrections after verifying the concrete finding, even\nwhen their severity is low. Do not auto-dismiss them merely as cosmetic. Keep\nreal ambiguity, meaningful error context, invariants and language requirements;\nre-test and re-review semantic changes. This does not expand publication scope.\n\n**Auto-fix**: apply the fix immediately without asking. No user input needed.\n\n**Auto-dismiss**: drop the finding silently. No user input needed.\n\n**Discuss**: the evidence is weak, reviewers disagree, or the specific public\nerror-contract change lacks authorization. Show the user the full finding and\nask what to do. Do not edit an unauthorized public error-contract change before\nauthorization.\n\n**Defer to GitHub** is NOT a default action. Only use it when:\n\n- The user explicitly asks to defer a specific finding, OR\n- A fix is large enough that it should be a separate stacked PR (e.g., a\n  multi-file refactor or new feature, not a surgical bug fix)\n\nWhen in doubt, fix it now.\n\n## 7. Present the plan and auto-apply\n\nPrint the plan as a table, in severity order:\n\n```\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nReview-loop triage — \u003CN> findings (iteration \u003CI>)\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n # | sev      | action       | title\n---+----------+--------------+------------------------\n 1 | critical | auto-fix     | Off-by-one in batch loop\n 2 | high     | auto-fix     | Missing auth check on \u002Fadmin\n 3 | medium   | auto-fix     | Add retry on transient errors\n 4 | medium   | DISCUSS      | Lock contention in hot path\n 5 | nit      | auto-dismiss | Rename variable for clarity\n\nFull details: \u003Cpath to review.md>\n```\n\n**Auto-fix and auto-dismiss findings proceed immediately — no user input.**\n\nFor **discuss** findings only, use `AskUserQuestion`:\n\n```\nQ: [#N] \u003Ctitle> — sev \u003Cseverity>. Decision needed — what should I do?\n   options:\n     - \"Fix now\" (Recommended) — implement the fix in this session\n     - \"Dismiss\" — drop it, not a real issue\n     - \"Defer\" — too large for this PR, will stack separately\n     - \"Show me the details\" — read the full finding first\n```\n\nIf the user picks \"Show me the details\", present the finding conversationally\nand re-ask without that option.\n\nAfter resolving discuss items, print the consolidated plan:\n\n```\nPlan:\n  Fix now (4):     #1, #2, #3, #4\n  Dismiss (1):     #5\n```\n\n## 8. Apply verified fixes centrally\n\nGroup findings by file or tightly coupled feature. Independent read-only agents\nmay verify current code and propose precise repairs in parallel; they must not\nedit the shared checkout or run mutating commands. Apply dependent source edits\ncentrally in the parent, preserving unrelated working-tree\u002Findex changes.\n\nFor each finding, re-read the current source and verify it still applies. Make\nthe smallest correct change, add required regression coverage, and record the\nowned delta. If the fix grows beyond its authorized scope, re-triage instead of\nsilently expanding it. Keep review-only callers read-only.\n\nSeparate mutating workers\u002Fworktrees require the independently owner-authorized\nconcurrency allowed by global policy; assigning disjoint files is not itself\npermission. Ordinary review-loop fan-out remains read-only.\n\n### Compile gate\n\nAfter **all** fix-now items are done (serial and fan-out merged), run the\n**compile gate** before any re-review: the project's fastest typecheck scoped to\nwhat was touched (for Rust, `cargo check -p \u003Ctouched crates>`; otherwise the\nproject's equivalent). Fix any compile errors immediately — never enter a\nre-review pass with code that doesn't compile; that wastes an entire pass. The\ncompile gate is NOT a substitute for the project's check command — full tests\nand lints still run only after convergence.\n\nThen proceed directly to step 9 (re-review).\n\n## 9. Re-review loop (delta + escalation)\n\nRe-review after every fix pass to catch issues introduced by the fixes. This is\nthe core of the automatic loop.\n\n**CRITICAL: The re-review is NOT optional.** After fixing findings, you MUST\nre-review at least once. Do not skip it because the fixes \"looked\nstraightforward.\" Only a review pass determines when the loop is done.\n\n**CRITICAL: Convergence requires a CLEAN review pass.** The loop is ONLY done\nwhen a review pass returns no new actionable findings. Fixing the last batch is\nNOT convergence. The pattern is always:\n`review → fix → review → fix → review(clean) →\ncheck → done`. You can never end\non a fix. The project's check command runs only after convergence, and if it\nmakes changes, you re-enter the loop.\n\n### Choose the re-review mode\n\n**Stack mode:** use the already recorded owned fix-delta artifact and immutable\nparent\u002Fhead patch from step 2. Export the scoped committed source to an\nagent-owned review directory for read-only reviewers; provide the owned overlay\nseparately. Do not execute the shell block below in stack mode. Unknown changes\nor unavailable branch-source\u002Foverlay evidence block re-review, not count as\nclean.\n\n**Single-branch mode only:** compute the uncommitted fix delta against HEAD:\n\n```bash\ngit diff HEAD > \"$out_dir\u002Fdelta-iter${N}.patch\"\ngit diff HEAD --stat | tail -1\ngit diff \"$parent\" > \"$out_dir\u002Fdiff-iter${N}.patch\"   # updated full diff\n```\n\n**Markdown re-review.** Any changed `.md` file requires a fresh power-unslop\npass over the current scoped Markdown set and relevant cross-document context,\neven when the code delta is small. Re-bind the review to current saved bytes.\nThis prose lane need not rerun unrelated code reviewers, but cannot be omitted\nfrom a clean result.\n\n**Formatter-only skip (non-Markdown).** If the only thing that changed since the\nlast reviewed state is the output of a deterministic formatter\u002Fhook\n(`cargo fmt`, `deno fmt`, `prettier`, `yamlfmt`, `nixfmt`) and that formatter\nnow passes, **do not spawn a review pass over it** — formatter output cannot\nintroduce a review-worthy finding. Confirm the delta matches what re-running the\nformatter produces; if any hand-written line changed, fall through to the normal\nmodes. Treat a pure-formatter delta as verified by construction and skip to\nconvergence. If Markdown changed, run the Markdown re-review above instead; do\nnot carry an old prose hash or cross-document verdict forward as if it covered\nthe new text.\n\n**Escalate to a full panel pass** (re-run the review engine — review-core steps\n1–7 — with the updated full diff, applying review-core's adaptive sizing; reuse\nthe workflow `scriptPath` from step 4) when any of:\n\n- the fix delta exceeds ~200 changed lines, OR\n- the fixes touched files that no fixed finding implicated (scope grew), OR\n- the fixes touched **security-sensitive paths** (auth, secrets,\n  payment\u002Ffinancial, on-chain, migrations) — a fresh independent pass is worth\n  the cost here even for a small delta.\n\n**Otherwise run delta mode** — the default and fast path. One small workflow: a\nfix-verifier per fixed finding plus one independent native broad sweep of the\nfix delta. Pass `args`:\n`{fixedFindings: \u003Cfindings fixed this loop so far>, deltaDiffPath,\nfullDiffPath, repoRoot, docsPaths, reviewSource, tierModels, markdownFiles,\nmarkdownPromptPath}`.\nAlways supply `markdownFiles` from the scoped manifest, including an explicit\nempty array when none exist. For a nonempty list, supply an existing Markdown\nprompt using power-unslop's whole-set contract. Never infer that a missing\nMarkdown result means there were no Markdown files. `tierModels` is retained for\ncompatibility; both fields name `openai-codex\u002Fgpt-6.1-sol`, and the workflow\npins that model rather than selecting by provider or tier. `reviewSource` must\ncontain `mode` (`single` or `stack`), `branch`, `parentSha`, `headSha`,\n`sourceRoot`, and `ownedDeltaPath`, all resolved from step 2. In stack mode\n`sourceRoot` is the exported committed branch source, never the combined\nworkspace; in single mode it is the current source root. Both modes name the\nexact owned delta artifact. Missing scope is blocked, not a clean review. Reuse\nthe returned `scriptPath` only with refreshed scope and artifact inputs on later\npasses.\n\n```javascript\nconst meta = {\n  name: \"review-delta\",\n  description: \"Verify applied fixes and sweep the fix delta for new issues\",\n  phases: [\n    { title: \"Verify fixes\", detail: \"one verifier per fixed finding\" },\n    { title: \"Sweep\", detail: \"broad review of the fix delta\" },\n  ],\n};\n\nconst FINDING = {\n  type: \"object\",\n  required: [\n    \"title\",\n    \"severity\",\n    \"file\",\n    \"line_start\",\n    \"line_end\",\n    \"category\",\n    \"finding\",\n    \"why_it_matters\",\n    \"recommended_fix\",\n    \"confidence\",\n  ],\n  properties: {\n    title: { type: \"string\" },\n    severity: { enum: [\"critical\", \"high\", \"medium\", \"low\", \"nit\"] },\n    file: { type: \"string\" },\n    line_start: { type: \"integer\" },\n    line_end: { type: \"integer\" },\n    category: {\n      enum: [\n        \"correctness\",\n        \"security\",\n        \"convention\",\n        \"maintainability\",\n        \"tests\",\n        \"doc-coherence\",\n      ],\n    },\n    finding: { type: \"string\" },\n    why_it_matters: { type: \"string\" },\n    recommended_fix: { type: \"string\" },\n    confidence: { type: \"integer\" },\n  },\n};\n\nconst VERIFY_FIX_SCHEMA = {\n  type: \"object\",\n  required: [\"fixed\", \"rationale\"],\n  properties: {\n    fixed: { type: \"boolean\" },\n    rationale: { type: \"string\" },\n    new_issues: { type: \"array\", items: FINDING },\n  },\n};\n\nconst SWEEP_SCHEMA = {\n  type: \"object\",\n  required: [\"findings\"],\n  properties: {\n    findings: { type: \"array\", items: FINDING },\n    clean_reason: { type: \"string\" },\n  },\n};\n\n\u002F\u002F The harness may deliver args as a JSON-encoded string instead of a\n\u002F\u002F parsed object — parse defensively before destructuring.\nconst parsedArgs = typeof args === \"string\" ? JSON.parse(args) : args;\nconst {\n  fixedFindings,\n  deltaDiffPath,\n  fullDiffPath,\n  repoRoot,\n  docsPaths,\n  reviewSource,\n  tierModels,\n  markdownFiles,\n  markdownPromptPath,\n} = parsedArgs;\n\u002F\u002F All native lanes use the current authenticated model.\nconst lightModel = \"openai-codex\u002Fgpt-6.1-sol\";\nconst scopeFields = [\n  \"branch\",\n  \"parentSha\",\n  \"headSha\",\n  \"sourceRoot\",\n  \"ownedDeltaPath\",\n];\nif (\n  !reviewSource || ![\"single\", \"stack\"].includes(reviewSource.mode) ||\n  scopeFields.some((key) =>\n    typeof reviewSource[key] !== \"string\" || !reviewSource[key].trim()\n  )\n) {\n  return {\n    status: \"blocked\",\n    reason: \"Missing explicit review source identity\",\n  };\n}\nconst sourceContext =\n  `Review source identity: ${JSON.stringify(reviewSource)}. ` +\n  `Read only the named sourceRoot plus ownedDeltaPath. In stack mode this is ` +\n  `committed branch source plus its owned overlay, never the combined workspace. `;\n\nif (\n  !Array.isArray(markdownFiles) ||\n  (markdownFiles.length > 0 &&\n    (typeof markdownPromptPath !== \"string\" || !markdownPromptPath.trim()))\n) {\n  return {\n    status: \"incomplete\",\n    phaseErrors: [\"Missing Markdown review scope\u002Fprompt\"],\n  };\n}\nconst markdownRequired = markdownFiles.length > 0;\nconst MARKDOWN_SCHEMA = {\n  type: \"object\",\n  required: [\"findings\", \"reviewedFiles\", \"unreadFiles\"],\n  properties: {\n    findings: { type: \"array\", items: FINDING },\n    reviewedFiles: { type: \"array\", items: { type: \"string\" } },\n    unreadFiles: { type: \"array\", items: { type: \"string\" } },\n  },\n};\n\nconst [verifications, sweep, markdown] = await parallel([\n  () =>\n    parallel(fixedFindings.map((finding) => () =>\n      agent(\n        sourceContext +\n          `A code review flagged this finding and a fix was applied:\\n` +\n          `${JSON.stringify(finding)}\\n\\n` +\n          `The fix delta (uncommitted changes) is at: ${deltaDiffPath}\\n` +\n          `The full PR diff (context) is at: ${fullDiffPath}\\n` +\n          `Repo root: ${repoRoot}\\n\\n` +\n          `Read the scoped source and owned overlay at the finding's location. Confirm the fix ` +\n          `fully resolves the finding — not partially, not by suppressing the ` +\n          `symptom — and check the surrounding code for issues the fix may ` +\n          `have introduced. Report new_issues only for problems caused by or ` +\n          `directly adjacent to the fix.`,\n        {\n          cwd: repoRoot,\n          label: `verify-fix:${finding.title}`,\n          phase: \"Verify fixes\",\n          model: lightModel,\n          schema: VERIFY_FIX_SCHEMA,\n        },\n      ).then((result) => result && ({ finding, ...result }))\n    )),\n  () =>\n    agent(\n      sourceContext +\n        `You are a senior staff engineer reviewing a set of fixes applied in ` +\n        `response to a code review. The fix delta is at: ${deltaDiffPath}. ` +\n        `The full PR diff (context) is at: ${fullDiffPath}. Project docs: ` +\n        `${docsPaths.join(\", \")}. Repo root: ${repoRoot}.\\n\\n` +\n        `Review the fix delta holistically: bugs, broken invariants, ` +\n        `interactions with the rest of the PR, convention violations from the ` +\n        `project docs. Apply the same bar as a full review — correctness ` +\n        `first; enforce required code conventions without inventing personal style ` +\n        `nits, and do not duplicate compiler or linter diagnostics. ` +\n        `Return findings, or an empty list with clean_reason if clean.`,\n      {\n        cwd: repoRoot,\n        label: \"delta-sweep\",\n        phase: \"Sweep\",\n        model: lightModel,\n        schema: SWEEP_SCHEMA,\n      },\n    ),\n  () =>\n    markdownRequired\n      ? agent(\n        sourceContext +\n          `Read ${markdownPromptPath} and the complete scoped Markdown set: ` +\n          `${\n            JSON.stringify(markdownFiles)\n          }. Be the independent power-unslop critic; ` +\n          `check cross-document logical consistency and relevant controlling\u002Flinked docs. ` +\n          `Do not edit or spawn another critic. Report reviewedFiles for scoped files ` +\n          `only and unreadFiles for any incomplete required coverage.`,\n        {\n          cwd: repoRoot,\n          label: \"markdown-consistency\",\n          phase: \"Sweep\",\n          model: lightModel,\n          tools: [\"read\"],\n          schema: MARKDOWN_SCHEMA,\n        },\n      )\n      : Promise.resolve({ findings: [], reviewedFiles: [], unreadFiles: [] }),\n]);\n\nconst phaseErrors = [];\nif (\n  !Array.isArray(verifications) || verifications.length !== fixedFindings.length\n) {\n  phaseErrors.push(\"Missing fix-verification results\");\n}\nfor (let index = 0; index \u003C fixedFindings.length; index++) {\n  const result = verifications?.[index];\n  if (\n    !result || result.status === \"blocked\" || typeof result.fixed !== \"boolean\"\n  ) {\n    phaseErrors.push(`Fix verifier ${index} did not complete`);\n  }\n}\nif (!sweep || sweep.status === \"blocked\" || !Array.isArray(sweep.findings)) {\n  phaseErrors.push(\"Sweep did not complete\");\n}\nconst reviewedMarkdown = new Set(markdown?.reviewedFiles ?? []);\nif (\n  !markdown || markdown.status === \"blocked\" ||\n  !Array.isArray(markdown.findings) || !Array.isArray(markdown.unreadFiles) ||\n  markdown.unreadFiles.length > 0 ||\n  markdownFiles.some((path) => !reviewedMarkdown.has(path)) ||\n  reviewedMarkdown.size !== new Set(markdownFiles).size\n) {\n  phaseErrors.push(\"Markdown review did not complete\");\n}\nreturn {\n  status: phaseErrors.length > 0 ? \"incomplete\" : \"completed\",\n  phaseErrors,\n  expectedVerifications: fixedFindings.length,\n  verifications: verifications ?? [],\n  sweepFindings: Array.isArray(sweep?.findings) ? sweep.findings : null,\n  markdownFindings: Array.isArray(markdown?.findings)\n    ? markdown.findings\n    : null,\n};\n```\n\n**Overlap the check command with an escalated full-panel pass.** A delta pass is\ncheap, so running the check command only after it converges is fine. But when\nthis iteration **escalated to a full panel** (slow), start the project's check\ncommand in the background as you fire the panel — they read the same working\ntree and don't interact — then gate convergence on both: panel clean **and** the\ncheck command green with no changes → converged; panel clean **and** the check\ncommand made only formatter changes → apply the formatter-only skip; panel not\nclean → discard the in-flight check result (it reruns at the next convergence).\nNever overlap the check command with a cheap delta pass — the wasted runs aren't\nworth it. (Skip entirely if the project declared no check command.)\n\n### Interpret the result\n\n1. Save the result to `$out_dir\u002Fdelta-iter${N}.json` (audit trail).\n2. **Clean pass** requires `status: completed`, no phase errors, exactly the\n   expected verifier count, every verification `fixed: true` with no\n   `new_issues`, and completed empty `sweepFindings` and `markdownFindings`.\n   Missing, blocked or malformed results are incomplete, never empty success.\n   The loop has converged. Run the project's check command (`check_cmd`) and let\n   it run until it passes or it needs the user. If the project declared **no**\n   check command (`check_cmd` empty), there is nothing to run, so skip straight\n   to step 10\u002F11. If the check command itself commits or amends on success, that\n   behavior is **overridden by this loop**: never amend in single-branch mode\n   (hard rule 4); in stack mode the stack flow amends once per branch after\n   convergence, so the check command must not amend separately.\n   - If the check command made **no code changes**: proceed to step 10\u002F11.\n   - If it **made code changes** (lint, formatting, auto-fixes): run one more\n     delta pass over the new delta. This converges quickly since those changes\n     are mechanical.\n3. **Not clean**: preserve phase errors and all unresolved findings\n   (`fixed: false`), new issues, sweep findings and Markdown findings. A failed\n   fix verification is not dismissed because the same finding appeared in an\n   earlier iteration. Deduplicate only equivalent current findings without\n   dropping their unresolved status; recover missing phases before claiming\n   convergence. Then continue triage and re-review under the existing scope.\n\n**Cap at 4 review passes total** (full or delta — initial + up to 3 re-reviews).\nIf new findings keep appearing after 4 passes, stop and tell the user — the\nfixes are likely introducing as many issues as they solve, and a human needs to\nassess.\n\nPrint a status line at the start of each iteration:\n\n```\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nRe-review iteration \u003CN> (\u003Cdelta|full panel>) — checking for new issues\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n```\n\nWhen an escalated full pass re-runs the engine, treat any external pool that\nerrored earlier in this invocation as exhausted and re-resolve the lane\nassignment **without re-probing** it.\n\n## 10. Defer-to-GitHub loop (only if user explicitly deferred findings)\n\nThis step only runs if the user chose \"Defer\" for any discuss finding. Skip\nentirely if no findings were deferred.\n\nEvery deferred review finding requires exact per-issue approval. Routine\nplanning has separate authority and public-content checks; this skill grants no\nplanning-issue creation authority.\n\nFor each deferred finding:\n\n1. **Draft the issue** in the repository's approved `.tmp\u002F` area and record\n   artifact provenance. Follow the repository's issue template and\n   public-content rules; never copy private correspondence or internal logs into\n   the draft.\n   - **Title:** describe the concrete problem in the repository's issue style.\n   - **Body** (in the tempfile):\n\n     ```markdown\n     ## Problem\n\n     \u003Cissue text from the finding>\n\n     ## Evidence\n\n     - File: `\u003Cpath>:\u003Cline-range>`\n     - Finding category: \u003Ccorrectness | security | convention | ...>\n     - Severity: \u003Cseverity>\n     - Found during review of branch `\u003Cbranch>` (commit `\u003Csha>`)\n\n     ## Verification rationale\n\n     \u003Cpublic-safe summary of the verifier's rationale; no private context>\n\n     ---\n\n     \u003Cverified public PR or commit link, when available>\n     ```\n\n2. **Choose only verified metadata.** Use labels that exist in the repository\n   and match its conventions. GitHub issues have no universal CLI priority\n   field; do not invent priority flags or infer an assignee's availability.\n\n3. **Show the exact draft to the user** before creating the issue. Format:\n\n   ```\n   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n   Draft GitHub issue — [#N] \u003Cfinding title>\n   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n   Title:    \u003Cdraft title>\n   Severity: \u003Cfinding severity, not a GitHub priority field>\n   Labels:   \u003Clabels>\n\n   \u003Cbody contents>\n   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n   ```\n\n4. **Ask for confirmation**, using `AskUserQuestion`:\n\n   ```\n   Q: Create this GitHub issue for finding #N?\n     options:\n       - \"Create\"    (Recommended)\n       - \"Edit\"      — tell me what to change\n       - \"Skip\"      — don't create this one\n   ```\n\n   If the user picks \"Edit\", ask what to change, revise, and re-confirm.\n\n5. **Create the issue** only after explicit confirmation:\n\n   Use the exact approved file with\n   `gh issue create --repo \u003Cowner\u002Frepo>\n--title \u003Capproved-title> --body-file \u003Capproved-file>`,\n   adding only approved metadata. Inspect CLI help before unfamiliar flags.\n   Reuse an existing exact approval instead of asking the same question again.\n\n6. **Verify and record the returned issue URL\u002Fnumber** for the summary and\n   associated local task. Retain the draft when creation fails or the outcome is\n   uncertain; reconcile remote state before retries to avoid duplicates. Clean\n   only the exact agent-created draft after successful verification.\n\nYou can batch the confirmation step: if there are multiple \"defer\" findings,\ndraft all of them first, show all drafts, ask in one `AskUserQuestion` call (up\nto 4 at a time). Don't skip showing the drafts — the user must see the title and\nbody before any issue is created.\n\n## 11. Summarize\n\nAfter all review iterations converge (no new findings) and any deferred GitHub\nissues are created (or skipped), print a final summary:\n\n```\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nReview loop complete — \u003CN> iteration(s), converged clean\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\nFixed (3):\n  #1  critical  Off-by-one in batch loop               \u003Cfile>:\u003Cline>\n  #2  high      Missing auth check on \u002Fadmin            \u003Cfile>:\u003Cline>\n  #4  medium    Lock contention in hot path             \u003Cfile>:\u003Cline>\n\nDeferred to GitHub (1):\n  #3  medium    Add retry on transient errors           \u003CGitHub issue URL>\n\nDismissed (1):\n  #5  nit       Rename variable for clarity\n\nReports: \u003Cpaths to review.md and delta-iter*.json>\n```\n\nIn single-branch mode, follow the repository's publication rules; this skill\nalone does not authorize an amend, commit, or push.\n\n**In stack mode**, this is where the single-branch loop returns to the Stack\nflow: the GitButler wrapper, only in a verified managed main worktree, absorbs\nfixes with `but absorb` and advances through the series. Plain-Git and linked\nworktrees remain in single-branch mode. Print the per-branch summary line, then\ncontinue the upstack walk — do not stop here. Follow the global checkpoint\ncadence while advancing and publish any remaining work at the end; stack mode\ndoes not impose an end-only publication gate.\n\n---\n\n## Failure modes\n\n- **A required native lane errors:** retain incomplete status and its reason;\n  selected inspectors are required. Follow review-core's missing-work recovery.\n- **Review returns no findings:** review-core full-panel results require\n  `status: completed` for a clean success. Step 9 delta results use that step's\n  verification and sweep convergence criteria instead. Missing required evidence\n  remains incomplete; an empty findings list alone is not success.\n- **A fix turns out to be larger than expected:** stop, report progress, ask\n  whether to continue, defer to a stacked PR, or dismiss.\n- **Review pass cap hit (4 passes):** stop and tell the user. Summarize what was\n  fixed in each iteration and what new issues keep appearing.\n- **The workflow itself fails mid-run:** relaunch with\n  `{scriptPath, args,\n  resumeFromRunId}` — completed lanes return cached\n  results instantly; only the failed part re-runs.\n- **A GitHub issue fails to create:** report the exact `gh` error, leave the\n  draft tempfile in place, and continue with the rest of the deferred items. Ask\n  the user whether to retry the failed one at the end.\n- **The user says \"stop\" mid-loop:** immediately stop, then print the summary\n  with what was completed so far. Do not silently abandon the rest.\n\n## Hard rules\n\n1. **Auto-fix without asking** for findings that match auto-fix criteria. Only\n   ask the user about \"discuss\" findings.\n2. **Bias toward fixing now.** Defer to GitHub only when the user explicitly\n   asks or the fix is too large for the current PR.\n3. Never create GitHub issues for deferred review findings without explicit\n   per-issue user confirmation of the exact draft content.\n4. **Single-branch mode:** never amend, commit, or push — leave the fixes\n   uncommitted for the user to review unless repository policy independently\n   authorizes publication. **Stack mode, only in a verified GitButler-managed\n   main worktree:** `but absorb` into each branch is expected; checkpoint timing\n   and publication scope follow `GLOBAL_AGENTS.md`'s managed-main workspace\n   workflow, not an end-only or selected-branch push. Linked and other plain-Git\n   worktrees remain in single-branch mode. The fixes must reach the PRs. This\n   skill alone does not authorize draft→ready changes, new PRs, PR comments or\n   branch-protection overrides.\n5. Use `gh issue create --body-file` with the approved body file, not inline\n   escaped Markdown.\n6. Always re-verify findings against the current source before applying fixes —\n   the code may have changed since the review.\n7. Keep fixes surgical. No \"while I'm here\" cleanups.\n8. Parallelize independent read-only verification\u002Fproposals; apply source edits\n   centrally. Disjoint files do not authorize parallel writers. Any separately\n   authorized concurrent worker follows global ownership\u002Fworktree policy.\n9. Run the compile gate after every fix pass; run the project's check command\n   (`check_cmd`, or skip if none) only after the review loop converges clean. If\n   it makes code changes, run another delta pass.\n10. Cap at 4 review passes (full or delta). Convergence requires a clean pass —\n    never end on a fix. Stop and ask the user if you don't converge.\n11. The review pass runs as a single `Workflow` invocation (review-core), using\n    read-only native `openai-codex\u002Fgpt-6.1-sol` lanes. Do not launch external\n    model CLIs. Verification and synthesis happen inside the workflow, never in\n    the main session.\n12. Delta mode is only valid when the fix delta is small (~200 lines) and\n    confined to files implicated by fixed findings — otherwise escalate to a\n    full panel pass.\n13. Complete steps 1–2's global preflight and registered invocation-directory\n    creation before artifact writes; recheck after checkout transitions.\n",{"name":5,"description":7,"allowed-tools":43,"argument-hint":44,"user-invocable":45},"Bash(but:*), Bash(direnv:*), Bash(git:*), Bash(gh:*), Bash(command:*), Bash(cargo:*), Bash(nix:*), artifact_provenance, Bash(cat:*), Bash(mktemp:*), Bash(rm:*), Bash(test:*), Bash(grep:*), Bash(wc:*), Bash(uuidgen:*), Bash(basename:*), Bash(find:*), Read, Write, Edit, Agent, Workflow, AskUserQuestion",[29],true,"master","0d746517c6d8204286b50675ee0e43ed7bfa5b6a","ai\u002Fskills\u002Freview-loop",0,"https:\u002F\u002Fgithub.com\u002F0xgleb\u002Fdotconfig","https:\u002F\u002Fgithub.com\u002F0xgleb","2026-11-14 09:46:23",{"source":8,"skillName":5,"commands":54,"prompt":64,"zipAvailable":45},[55,58,61],{"tool":56,"command":57},"npx","npx skills add 0xgleb\u002Fdotconfig --skill review-loop",{"tool":59,"command":60},"bunx","bunx skills add 0xgleb\u002Fdotconfig --skill review-loop",{"tool":62,"command":63},"pnpm","pnpm dlx skills add 0xgleb\u002Fdotconfig --skill review-loop","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002F0xgleb\u002Fdotconfig\u002Fblob\u002Fmaster\u002Fai\u002Fskills\u002Freview-loop\u002FSKILL.md",[],[67,88,113,135,159,176],{"skillNo":68,"name":69,"nameZh":6,"description":70,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":71,"categories":72,"keywords":73,"publishedAt":38},"01M6DNKHP7NV7KR552KFZ6EW3R","worktree","Manage worktrees only for concurrent work by the owner or agents launched by the owner on the same repository, or for explicitly requested inventory and cleanup; never create one for isolation alone.","https:\u002F\u002Fgithub.com\u002F0xgleb\u002Fdotconfig\u002Fblob\u002Fmaster\u002Fai\u002Fskills\u002Fworktree\u002FSKILL.md",[],[69,74,75,76,77,78,79,80,36,23,33,81,82,31,83,84,85,86,87],"create","work","never","worktrees","manage","inventory","repository","cleanup","cd","isolation","ls","for","mkdir","true",{"skillNo":89,"name":90,"nameZh":6,"description":91,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":92,"categories":93,"keywords":94,"publishedAt":38},"01M6DNKEGPR8F3BA95ZMWQ48V9","unslop","Rewrite draft prose before owner-facing replies, docs, issues, PR text, handoffs, or Telegram reports to remove AI tells while preserving facts, links, tone, and authority; auto-trigger on externally visible prose, but never on code, commands, logs, tool output, quoted sources, or user text.","https:\u002F\u002Fgithub.com\u002F0xgleb\u002Fdotconfig\u002Fblob\u002Fmaster\u002Fai\u002Fskills\u002Funslop\u002FSKILL.md",[],[90,95,76,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112],"draft","pr","remove","trigger","tool","issues","auto","rewrite","code","tone","telegram","sources","links","authority","logs","facts","output","replies",{"skillNo":114,"name":115,"nameZh":6,"description":116,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":117,"categories":118,"keywords":119,"publishedAt":38},"01M6DNK9VFNJYKB6GMA15WJ3HZ","threat-model-first","Use at the START of a change that moves money, changes balances or custody, touches access control or signing, deserializes untrusted input, adds an external or on-chain integration, or wires an LLM tool. Design-time threat modeling that turns abuse cases into the first failing tests; it precedes the post-hoc security-review pass.","https:\u002F\u002Fgithub.com\u002F0xgleb\u002Fdotconfig\u002Fblob\u002Fmaster\u002Fai\u002Fskills\u002Fthreat-model-first\u002FSKILL.md",[],[120,121,122,123,124,125,126,127,128,129,130,31,131,18,132,133,26,25,24,134],"model","threat model","threat","first","threat model first","chain","time","security-review","design","forge","access","cargo audit","change","audit","modeling",{"skillNo":136,"name":137,"nameZh":6,"description":138,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":139,"categories":140,"keywords":146,"publishedAt":38},"01M6DNK6M72QAMH2TYVMPYJGDM","test-inspector","Auto-run for new or changed retained behavior, even without test changes, and for test, fixture, snapshot or mock changes; verify real happy-path and error-path coverage, expose false-confidence assertions and over-mocking, but do not perform general production-code correctness review.","https:\u002F\u002Fgithub.com\u002F0xgleb\u002Fdotconfig\u002Fblob\u002Fmaster\u002Fai\u002Fskills\u002Ftest-inspector\u002FSKILL.md",[141],{"categoryNo":142,"categoryName":143,"taxonomyType":144,"taxonomyTypeDesc":145},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[147,148,149,150,101,151,31,103,18,152,26,153,154,155,156,21,157,23,22,158],"test","test inspector","fixture","do","false","run","coverage","error","number","URL","snapshot","path",{"skillNo":160,"name":161,"nameZh":6,"description":162,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":163,"categories":164,"keywords":165,"publishedAt":38},"01M6DNK3BPN73D003FFADEWJP5","strong-typing-inspector","Lightweight review — flags primitives used where a domain type already exists (e.g. String for a USD field when Usd exists) and missed newtype opportunities.","https:\u002F\u002Fgithub.com\u002F0xgleb\u002Fdotconfig\u002Fblob\u002Fmaster\u002Fai\u002Fskills\u002Fstrong-typing-inspector\u002FSKILL.md",[],[166,167,147,168,96,169,26,170,171,23,172,173,31,174,18,175],"strong typing inspector","type","missed","domain","flags","grep","usd","gh","primitives","newtype",{"skillNo":177,"name":178,"nameZh":6,"description":179,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":9,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":180,"categories":181,"keywords":185,"publishedAt":38},"01M6DNJZHG2RK3MC4VPB9KWPYF","spec-review","Critique existing specifications and design proposals, including whether their approach or addition is justified, and refine them through adversarial Pi review and authorized author revisions. Not for code review, implementation-plan sequencing, creating a design from scratch or minor copy edits.","https:\u002F\u002Fgithub.com\u002F0xgleb\u002Fdotconfig\u002Fblob\u002Fmaster\u002Fai\u002Fskills\u002Fspec-review\u002FSKILL.md",[182],{"categoryNo":183,"categoryName":184,"taxonomyType":144,"taxonomyTypeDesc":145},"01JBSEEDCAT000000000000007","代码审查",[186,187,18,188,189,190,191,192,128,193,103,85,194,195,196,197,198,199,200,201],"spec review","spec","plan","critique","code review","pi","refine","implementation","sequencing","specifications","proposals","scratch","Existing","author","From Scratch","adversarial"]