review-loop

Review loop

One reviewer and one fixer alternate until nothing at or above the severity floor remains, the round budget runs out, or the two stop making progress. The loop decision is never made by a model: review_gate.py computes it from the findings file.

Configuration

Resolve once per run with ${CLAUDE_PLUGIN_ROOT}/scripts/ship_config.py, adding --plugin-config KEY=VALUE for each plugin option that is set and the skill's own flags last, and pass the plan or code section to the gate. The orchestrator skill owns that call; this skill only consumes its output.

Severity and confidence

Use the shared rubric from spicy-review: Critical, High, Medium, Low, plus a confidence score from 0 to 100. The gate drops anything under 80 before deciding. Reviewers apply the rubric's what-not-to-flag list and are told plainly that a round with no findings is a valid, expected result. A reviewer asked to find problems will find something; the floor is the structural fix for that.

Findings contract

Each round the reviewer writes <phase>-review-r<round>.json in the story's context folder. references/findings.schema.json is the normative schema.

{
  "reviewer": "code-reviewer",
  "target": "plan-012.md or a git range",
  "round": 2,
  "prior_findings": [{"id": "F1", "status": "resolved"}, {"id": "F2", "status": "unresolved"}],
  "findings": [
    {
      "id": "F2",
      "title": "Refresh token stored in plaintext",
      "severity": "High",
      "confidence": 90,
      "location": "src/auth/refresh.py:88",
      "category": "security",
      "problem": "The token is written to the sessions table unhashed, so a DB read leaks live credentials.",
      "fix": "Hash with bcrypt before insert; compare with bcrypt.checkpw on refresh."
    }
  ]
}