review

.agents/skills/review — the vendor review chain

A folder of scripts, not a workflow: the loop skills call these by path, and this file exists so the folder is a skill in the shape .agents/checks/check-skills.ts holds every folder here to.

Where things are found

• The repo under review is the caller's: code-review.ts reads CODEX_REVIEW_REPO, else git rev-parse --show-toplevel from the cwd, and exits 2 with one line when neither names a repo. It never falls back to the checkout this script sits in — that reviews the wrong tree.
• The other half of a cross-repo change is named by CODEX_REVIEW_COMPANIONS (worktree paths, comma-separated): the prompt lists each with its branch and tells the reviewer to read that repo there, not from the landed checkout, which does not carry the change yet. A path that is not a git checkout exits 2. Without it, a reviewer spends rounds on findings about code the companion worktree has already changed.
• The policy is policy.json beside these scripts: rows adversarial-review, judgment, panel and repo-investigation, each an ordered list of vendor CLIs (codex, grok; a claude slot means "dispatch your own agent"). tracks names an exact model for the CLI's -m; empty runs the CLI's own default. POLICY_JSON overrides the path; POLICY_CHAIN_RESOLVER overrides the model resolver.
• The author is left out. A review row skips the vendor recorded as agent= in .agents/harness (the model family that writes the code); the panel keeps every seat.
• The parsers blast-radius-symbols.ts uses — web-tree-sitter, tree-sitter-bash, typescript — are declared in package.json here and found in the workbench's own node_modules, then npm's global root (npm i -g typescript@5 web-tree-sitter tree-sitter-bash), then Node's own global node_modules. Without them the packer warns and falls back to a regex walk.