review-pr

Spawn all three in ONE message. This cuts context-gathering time by 60%. For agent-based review (Phase 3), all 6 agents are independent -- launch them together.

Phase 2: Skills Auto-Loading

CC auto-discovers skills -- no manual loading needed!

Relevant skills activated automatically:

• code-review-playbook -- Review patterns, conventional comments
• security-scanning -- OWASP, secrets, dependencies
• type-safety-validation -- Zod, TypeScript strict
• testing-unit, testing-e2e, testing-integration -- Test adequacy, coverage gaps, rule matching

Phase 3: Parallel Code Review (6 Agents)

Fork-eligible (CC 2.1.89 — ~60% cost cut): the 6 review agents are spawned together with no per-agent model= override and no worktree isolation, so CC forks them off the lead's cached prefix instead of re-sending it 6×. Do NOT add model= to these Agent() calls or wrap them in isolation: "worktree" — either breaks fork-eligibility. See chain-patterns/references/fork-pattern.md.

Project Context Injection

Before spawning agents, load project-specific review context from memory:

# Load project review context (conventions, known weaknesses, past findings)
# This gives agents project-specific knowledge without re-discovering patterns
PROJECT_CONTEXT = Read("${MEMORY_DIR}/review-pr-context.md")  # Falls back gracefully if missing

All agent prompts receive ${PROJECT_CONTEXT} so they know project conventions, security patterns, and known weaknesses from prior reviews.

Structured Output

All agents return findings as JSON (see structured output contract in agent prompt files). This enables automated deduplication, severity sorting, and memory graph persistence in Phase 5.

Anti-Sycophancy Response Protocol

All review agents and the coordinator MUST follow Read("${CLAUDE_PLUGIN_ROOT}/skills/shared/rules/anti-sycophancy.md"):

NEVER use: "Great work!", "Excellent!", "Nice!", "Thanks for catching that!", "You're absolutely right!", or ANY performative agreement.

INSTEAD: State findings directly. The code speaks for itself.

• "Fixed. Changed X to Y in auth.ts:42."
• "Security: JWT in localStorage. Move to httpOnly cookie."
• [Just fix it and show the diff]

When feedback seems wrong: Push back with technical reasoning. Not "I respectfully disagree." Just facts and evidence.

Agent Status Protocol

All agents MUST include a status field per Read("${CLAUDE_PLUGIN_ROOT}/agents/shared/status-protocol.md"):

• DONE — task completed, all requirements met
• DONE_WITH_CONCERNS — completed but flagging risks
• BLOCKED — cannot proceed
• NEEDS_CONTEXT — insufficient information

Domain-Aware Agent Selection

Only spawn agents relevant to the PR's changed domains:

Skip agents for domains not present in the diff. This saves ~33% tokens on domain-specific PRs.

Progressive Output (CC 2.1.76+)

Output each agent's findings as they complete — don't batch until synthesis.

Focus mode (CC 2.1.101): In focus mode, the user only sees your final message. Include the full review verdict, all findings by severity, and the approve/request-changes recommendation — don't assume they saw per-agent outputs.

• Security findings → show blockers and critical issues first
• Code quality → show pattern violations, complexity hotspots
• Test coverage gaps → show missing test cases

This lets the PR author start addressing blocking issues while remaining agents are still analyzing. Only the final synthesis (Phase 5) requires all agents to have completed.

Partial results (CC 2.1.98): If a review agent fails mid-analysis, synthesize partial findings:

for agent_result in review_results:
    if "[PARTIAL RESULT]" in agent_result.output:
        # A security agent that found 2 issues before crashing > no security review
        findings.extend(parse_findings(agent_result.output))
        findings[-1]["partial"] = True  # Flag in synthesis
        # Do NOT re-spawn — partial findings are still valuable

Monitor for CI streaming (CC 2.1.98): Stream CI check output in Phase 4:

Bash(command="gh pr checks $PR_NUMBER --watch 2>&1", run_in_background=true)
Monitor(pid=ci_watch_id)  # Each status change → notification

See Agent Prompts -- Task Tool Mode for the 6 parallel agent prompts.

See Agent Prompts -- Agent Teams Mode for the mesh alternative.

See AI Code Review Agent for the optional 7th LLM agent.

Phase 3.5: /ultrareview Gate (CC 2.1.111+, optional)

CC 2.1.111's built-in /ultrareview (parallel multi-agent deep review; Pro/Max get 3 free per month) overlaps Phase 3 but goes deeper. Never fire it by default — only when a trigger justifies the cost, and always ask first.

Load the gate: Read("${CLAUDE_SKILL_DIR}/references/ultrareview-gate.md") — trigger evaluation (large diff / sensitive path / reviewer disagreement / high-stakes label), the voice-friendly prompt + session-skip state, after-response handling, and the ORK_DISABLE_ULTRAREVIEW opt-out. If no trigger fires, skip silently to Phase 4.

Phase 4: Run Validation

Load validation commands: Read("${CLAUDE_SKILL_DIR}/references/validation-commands.md")

Phase 4.5: Adversarial Refutation (effort-gated)

A separate blind refuter verifies decision-bearing findings before they reach the Phase 5 verdict — the structural fix for self-preferential bias (the agent that raised a finding can't be its own fair judge). low/medium skip this phase; high runs single advisory refuters (no auto-flip); xhigh runs the engine's quorum (3 for a request-changes blocker, 2 for HIGH).

Load the protocol + review-pr bindings: Read("${CLAUDE_SKILL_DIR}/references/adversarial-refutation.md") (which loads the shared engine ${CLAUDE_PLUGIN_ROOT}/skills/shared/rules/adversarial-refutation.md).

Cross-model refuter (optional, provenance-labeled, cost-gated)

By default refuters are same-model Claude — variance reduction, not bias correction (N Claude agents share blind spots). When ORK_ALT_MODEL_CMD is configured AND effort is high/xhigh, one quorum slot per decision-bearing finding (request-changes blocker / CRITICAL / HIGH) can route to a different model family (Codex/GPT) for genuinely diverse failure modes. Off by default; the cross-model refuter SUBSTITUTES one same-model slot (never inflates the count or the §8 ceiling), is bound by the same blindness + citation-verify gates, stamps refuter_model for provenance, and CANNOT flip request-changes→approve on its own (engine §7). The skill owns no credentials and opens no egress — it shells out to the user-configured command (matches the egress guard #2533); absent command or down CLI → silent degrade to the same-model lane. Cost-capped by ORK_CROSS_MODEL_MAX (default 4); ORK_CROSS_MODEL=0 kills it. Load the operational doc: Read("${CLAUDE_SKILL_DIR}/references/cross-model-refuter.md").

Runs after Phase 3 findings (and any Phase 3.5 ultrareview merge) and Phase 4 validation, before the Phase 5 synthesis and Phase 6 verdict. Refuters are ALWAYS isolated Agent(...) spawns with no team_name. Refutation alone may demote a finding's bucket but may NOT flip request-changes→approve without explicit user confirmation, and ground truth (failing CI/tests/lint, npm-audit/CVSS) is never refuted. The ledger (refutation-ledger.json) records survived/killed/downgraded so wrong calls — wrong KEEPs and wrong KILLs — are auditable cross-session.

Phase 5: Synthesize Review

Combine all agent feedback into a structured report. Load template: Read("${CLAUDE_SKILL_DIR}/references/review-report-template.md")

Memory Persistence

After synthesis, persist critical/high findings to the memory graph for cross-session learning. The Phase 8c verdict writeback (below) handles this automatically when yg-mcp-core>=0.3.0 is installed; for interactive sessions, see references/memory-persistence.md for the manual mcp__memory__create_entities + mcp__memory__add_observations pattern.

Phase 6: Submit Review

# Approve
gh pr review $PR_NUMBER --approve -b "Review message"

# Request changes
gh pr review $PR_NUMBER --request-changes -b "Review message"

Phase 8c — Verdict KG writeback (signal-fired, optional)

After the verdict is submitted, optionally invoke scripts/verdict_writeback.py <review-dir> to persist the verdict + findings to the memory MCP knowledge graph. Self-skips on every non-happy-path so it never breaks the review:

python3 ${CLAUDE_SKILL_DIR}/scripts/verdict_writeback.py "$CLAUDE_JOB_DIR"

Auto-skip conditions (all exit 0, all WARN-logged):

Review dir must contain review-output.json (with verdict, repo, pr_number, optional findings: [{level, msg}], optional changed_paths: list[str]). Handoff JSON at <review-dir>/verdict-writeback.json records status (fired / skipped) + the constructed entity_name (review::<repo>#<n>@<ts>).

Mirrors the /ork:assess memory_writeback pattern from PR #1889. Closes orchestkit#1894.

CC 2.1.20 Enhancements

PR Status Enrichment

The pr-status-enricher hook automatically detects open PRs at session start and sets:

• ORCHESTKIT_PR_URL -- PR URL for quick reference
• ORCHESTKIT_PR_STATE -- PR state (OPEN, MERGED, CLOSED)

Session Resume with PR Context (CC 2.1.27+)

Sessions are automatically linked when reviewing PRs. Resume later with full context:

claude --from-pr 123
claude --from-pr https://github.com/org/repo/pull/123

Task Metrics (CC 2.1.30)

Load metrics template: Read("${CLAUDE_SKILL_DIR}/references/task-metrics-template.md")

Conventional Comments

Use these prefixes for comments:

• praise: -- Positive feedback
• nitpick: -- Minor suggestion
• suggestion: -- Improvement idea
• issue: -- Must fix
• question: -- Needs clarification

Agent Coordination

Context Passing

All review agents receive: changed files list, PR metadata (author, base branch), domain flags (has_frontend, has_backend, has_ai), and project review conventions from memory.

SendMessage (Cross-Review Findings)

When the security agent finds an issue the code-quality agent should also flag:

SendMessage(to="code-quality-reviewer", message="Security: auth middleware bypassed in route handler — flag as issue in review")

Agent Teams Alternative

For complex PRs (> 500 lines, 3+ domains), use mesh topology so reviewers can challenge each other:

# Load: Read("${CLAUDE_SKILL_DIR}/rules/agent-prompts-agent-teams.md")

Related Skills

• ork:commit: Create commits after review
• ork:create-pr: Create PRs for review
• slack-integration: Team notifications for review events

vs. the built-in /code-review (CC 2.1.146+)

CC bundles /code-review (renamed from /simplify): a single-pass correctness-bug check at a chosen effort level, with --comment to post findings as inline PR comments. Use it for a fast, focused "are there bugs in this diff?" pass.

Reach for /ork:review-pr instead when you want the full multi-agent review — parallel code-quality, security, testing, architecture, and performance passes synthesized into conventional comments with an approve / request-changes verdict. They are complementary, not redundant: /code-review is the quick correctness gate; /ork:review-pr is the thorough pre-merge audit.

References

Load on demand with Read("${CLAUDE_SKILL_DIR}/references/<file>"):

Rules: Read("${CLAUDE_SKILL_DIR}/rules/<file>"):

• AI Code Review Agent