issue-review

Run the required reviews for the active DSSE issue. Execute in order:

1. Run python3 "${CLAUDE_PLUGIN_ROOT}/scripts/issue_runner.py" status. Confirm an issue is loaded AND receipts.verified is set. If verified is null, stop. Tell the founder to run /issue-verify first. Reviewing unverified code wastes Codex runtime.

2. Pull the snapshotted scope. The runner stamped allowed_files into state at load/approve so mid-issue spec edits cannot expand the review surface:

   ALLOWED=$(python3 "${CLAUDE_PLUGIN_ROOT}/scripts/issue_runner.py" allowed-files)
   ISSUE_ID=$(python3 "${CLAUDE_PLUGIN_ROOT}/scripts/issue_runner.py" status | python3 -c "import sys,json; print(json.load(sys.stdin).get('issue_id',''))")
   

   $ALLOWED is a JSON array (e.g. ["q-ktlyst/.q-system/agent-pipeline/schemas/**","q-ktlyst/.q-system/scripts/**"]). If empty, stop and tell the founder the spec has no scope.

3. Try to claim a "standard" review slot before invoking Codex:

   python3 "${CLAUDE_PLUGIN_ROOT}/scripts/issue_runner.py" record-review standard
   

   • Exit 0: slot claimed, proceed to step 4.
   • The cap comes from the diff's size class (the ASK-1749 tier of the committed diff against origin/main, read by check_budget.size_class): S 1 standard and 0 adversarial, M 1 and 1, L 2 and 1. No classifier, an unreadable diff or uncommitted code counts as L. record-review standard --dry prints the class and both caps and claims nothing.
   • Exit 2: cap reached. The runner names the cap and the override env. Stop and ask the founder if they want to opt in via ISSUE_ALLOW_REVIEW_REPEAT=1 for a single retry, OR triage and close with the existing review.

4. Invoke codex:review (Codex native review) against origin/main. Build the focus text with the scope filter inline so Codex stays inside the contracted surface:

   Scope filter: $ALLOWED
   Limit findings to changes inside these paths. Code outside these paths is out of contract for this issue. If a finding requires touching files outside this list, mark it out-of-scope explicitly and do not propose a patch.
   

   Use --base origin/main --background unless the diff is trivially small (1-2 files). When the command returns, wait for completion via codex:result / codex:status. Paste the full verdict block to the founder verbatim.

   $REVIEW_SOURCE / $ADVERSARIAL_SOURCE name the reviewer that actually ran. Never substitute one for another.

   Reviewer that ran	$REVIEW_SOURCE	$ADVERSARIAL_SOURCE
   Codex	codex-review	codex-adversarial
   Claude senior-staff-engineer subagent	claude-review	claude-adversarial

   Pick the row for the reviewer that ACTUALLY ran. Stamping codex-* for a pass Codex did not run puts a false provenance record in the findings ledger — worse than being blocked, in a repo whose whole thesis is receipts. If one reviewer is unavailable (no credits, missing auth), use another row and stamp what ran. Do NOT hardcode an outage into this file: a stale availability note outlives the outage and sends every later session to the wrong reviewer. manual and plan are the author's own words and the writer refuses them here by design.

   Immediately pipe the standard-review findings to disk (compaction hardening: if the conversation compacts after this point, the findings survive because they are on disk, not in narrative memory). Translate Codex's free-form verdict into [{severity, body, affected_path}]. The writer assigns sequential ids, stamps created_at, marks out_of_scope=true for paths outside $ALLOWED, and sets disposition=pending:

   echo '<JSON_ARRAY>' | python3 "${CLAUDE_PLUGIN_ROOT}/scripts/issue_findings.py" \
     add "$ISSUE_ID" --source "$REVIEW_SOURCE" --allowed-files-json "$ALLOWED"
   

   If the standard review returned approve with no findings, skip the writer call for this source. Do this before invoking the adversarial pass in step 6.