pr-risk

name	pr-risk
description	Route a PR to the right amount of human review — classify a PR's risk so review attention goes where judgment is irreducible and the safe majority clears without a human. Review load should scale with risk, not PR count. Two layers — an optional deterministic floor (a small classifier you provide) plus an agent advisory pass (this skill) that may only escalate, never lower. Use when deciding how much review a PR needs, or invoke /pr-risk <owner/repo#num>.
argument-hint	[owner/repo#num] — omit to use the current branch vs its base
user_invocable	true

/pr-risk — route a PR to the right amount of human review

Classify a PR's risk so review attention goes where judgment is irreducible and the safe majority clears without a human. Review load should scale with risk, not PR count.

Two layers: an optional deterministic floor (a small, reproducible classifier — the safety guarantee) and an agent advisory pass (this skill — may only escalate above the floor, never lower it). With no floor tool wired up, the skill runs advisory-only and fails closed.

When to use

• Deciding how much review a PR needs before requesting reviewers or merging.
• Inside a driver/automation loop that wants to auto-clear safe PRs and escalate risky ones.
• /pr-risk <owner/repo#num> or /pr-risk (current branch vs its base).

Not for reviewing the PR — this only routes; it sits upstream of the actual review.

Steps

1. Get the diff

• PR: gh pr diff <num> -R <owner/repo>
• Local branch: git diff <base>...HEAD

2. Deterministic floor — run the classifier, do NOT eyeball it

If you have a floor classifier (a tool that reads a diff on stdin and prints a tier + the signals it fired), run it — it's reproducible, so it's the authoritative baseline. Point FLOOR_BIN at it:

gh pr diff <num> -R <owner/repo> | "$FLOOR_BIN" -v

It prints floor=Tx and the fired signals (path / content / dependency / control-plane / policy / size). This floor is authoritative — you may raise it, never lower it. With no floor tool, start from T2 (fail-closed) and let the advisory pass set the tier.

3. Agent advisory pass (escalate-only)

Read the diff against your risk rubric. Propose an escalation only for the semantic residual a pattern-matcher can't express — the known triggers:

• a logic change widening a trust boundary with no telltale path (sandbox-disable, CI checking out untrusted PR-head, a loosened permission);
• a default whose production impact needs understanding, not pattern-matching;
• a refactor that relocates policy / invariant / state-machine-bearing code (mechanical-looking ≠ low-risk when the code owns invariants).

If nothing warrants it, escalation = none. Never lower the floor. When you escalate a new pattern, note it — recurring ones should graduate into a deterministic signal in the floor classifier, which is where trust belongs.

4. Reconcile + route

final = max(floor, escalation). Route by tier:

• T0 → auto-merge eligible, but only the narrow safe slice (tests-only / generated / non-policy docs, control-plane excluded). Default to recommend-only — don't auto-merge unless you've explicitly enabled it.
• T1 → one peer review
• T2 → owner (CODEOWNERS) review required
• T3 → owner + adversarial skeptic pass + author "why this is safe" defense

5. Log (optional)

Append one JSON line to a decisions log so recurring escalations can graduate into the floor:

{"pr":"owner/repo#123","floor":"T2","escalation":"T3","final":"T3","why":"CI checks out PR-head — fork trust boundary","route":"owner+adversarial"}

6. Print the verdict

One tight block: final tier + route, the fired floor signals, and the escalation (if any) with its reason. No narration.

Invariants

• The floor is code, not judgment — reproducible across runs. All nondeterminism lives in this advisory pass, which can only escalate.
• Fail-closed: no diff / no rubric → T2, never T0.
• Control-plane edits (the rubric / this skill / CODEOWNERS) are T3 — changing the classifier is the highest-risk class, not the lowest.

Notes

• Keep new policy in your rubric, new deterministic signals in the floor classifier, and only genuinely-semantic judgment in this skill. The floor is the safety layer; the agent advisory reclaims the semantic residual and must keep earning its slot.