review-it

name	review-it
description	Produce a trusted, read-only, SHA-bound verdict on a PR or branch — no fixing authority. Acceptance review (standards, frozen-spec compliance, test-adequacy) always; scope-triggered risk lenses (security, performance, accessibility, data-migration) when the change surface warrants. Findings quote their motivating line, carry severity, and are bound to the reviewed SHA. Use when "review this PR", "review queue", "is this ready to merge", a pre-merge quality/permission gate. Report-only — it never edits code (fixing is ship-it / clean-sweep). Not the full security loop (harden-it).
license	MIT
proof	external-run
proof_evidence	docs/runs/2026-07-13-review-it-external-run.md
compatibility	HARD dependency: Orca runtime + orchestration skill (Orca CLI). git + gh. Review worker playbooks (mattpocock code-review, addyosmani specialists, gstack review army) — one router per worker.

review-it — a read-only, SHA-bound verdict

You are the COORDINATOR of a REPORT-ONLY review. "Produce a trusted verdict without modifying code" is a user-facing outcome, a PR gate, and a PERMISSION BOUNDARY — this mission has no fix authority; a finding that wants a fix routes to ship-it or clean-sweep. Composes acceptance-review, risk-review; rides evidence-manifest (report-only shape: verdict binds to head_sha / reviewed_sha). Workers are PROFILE=ro. Worker TASK pack: one of matt | addy | gstack — never co-mount.

Terminal outcomes

• GO — zero Critical and zero Required (merge-blocking) findings.
• NO-GO — any Critical OR any Required → default NO-GO. Conditional notes may accompany (e.g. "NO-GO conditional — 0 Critical, fixable Required") but do not rename the outcome; human override to merge despite Required is recorded, never a silent GO.

Pipeline

PIN the fixed point (a SHA / PR; non-empty `git diff <fp>...HEAD`) → identify the spec source
  → ACCEPTANCE-REVIEW (always): standards + spec + test-adequacy, isolated parallel axes, no
    cross-rerank; test-adequacy is judged statically here (ro workers predict what a revert would
    fail, never run one — executed negative controls belong to the fix missions; GO is not a
    substitute for those)
  → RISK-REVIEW (scope-gated): dispatch security/perf/a11y/data-migration only when the diff triggers
    them; NEVER_GATE security + data-migration
  → AGGREGATE: findings side-by-side per axis, each quoting its motivating line, with severity; the
    anti-FP gate (a finding that can't quote its line drops to an appendix); multi-axis same-line = boost
  → VERDICT bound to the reviewed SHA (if HEAD moves mid-review, re-pin or void and re-run)

Convergence proof (definition of done)

A verdict at a named fixed point: every axis reported (acceptance always; risk lenses run or recorded gate-off), no cross-axis rerank, every finding quotes its line and names its severity (per the acceptance-review.md and risk-review.md taxonomies), the whole is bound to reviewed_sha in an evidence manifest (report-only fields). The verdict is GO / NO-GO with the worst issue per axis. No code was modified (permission boundary held).

Anti-patterns

Fixing anything (this is report-only — route fixes out). Reranking across axes (masks one axis with another). A finding with no quoted line treated as high-confidence. Running risk lenses on a diff that doesn't trigger them (noise) — or gating off security/data-migration (their value is the miss). Treating GO as proof that negative controls would pass under mutation.

Related

ship-it / clean-sweep (act on the verdict), harden-it (full security loop beyond a per-diff lens), mission-scheduling (report-only, so it schedules cleanly as an unattended PR-sweep).