tags:

• agents
• documentation

Changelog

Versions match metadata.version in SKILL.md and plugin.json. Update an installed copy with:

npx skills check                      # is there anything new?
npx skills update unified-code-review

1.4.11 — 2026-10-05

• One promotion path. Routing now says how to read. Pincer depth stays in the §2c tier table. PASS / ADVISORY / BLOCKERS stay in Verdict rules, checked again by the pre-send checklist. The old consistency-lock restatement of those gates is gone; the one rule it alone carried — ### Verdict is the only sensor verdict — sits on Verdict rules.
• Domains beside the tier (auth, data, webhook, infra, or another short word; none for copy/docs). Domain picks questions the skill already asks. It does not set tier or pincer depth.
• History candidates on MEDIUM and HIGH: git blame -L or git log -L on touched hunks. A reverted fix or a broken stated invariant is a candidate (SHA + line), not a finding, until the live-path gate and, when the claim is wiring, §2c. A reverted fix is not [preexisting]. Skip on LOW and on files the diff creates. Report line: History: skipped | none | candidate.
• Candidate finders are optional and host-agnostic. A finder may return file:line and a claimed failure. Only this rubric promotes it. Finder agreement is not evidence.
• Sources: rdeepak history agent; HermeticOrmus domain-before-checklist. Methods only.

1.4.10 — 2026-09-22

• Hot path: a high-traffic or cannot-degrade journey raises effective risk even when the diff is small. Name it; report hot path: yes | no on the reversibility line.
• Pass 3 advisories (not new blocker rows): [parallel_path] (new way, or wrong system; #7 is only a named util), [unearned_defense] (checks, freshness, or fallbacks with no production failure — a deletable layer stays #1, silent swallowing stays #6), [unproven_removal] (deletion needs a metric, log, or explicit no-remaining-callers note).
• §2b: a second model still misses these; agreement is not evidence they are absent.
• Overlay: REVIEWS.md may state accepted risks and the standard home for a change; quote that law under the finding.
• Sources: Sean Goedecke (large established codebases; beat the models).
• Size: dropped the Pass 3 blockquote and the “ambition” line (both restated code judo / “it works”), the duplicated per-journey sentence in question 3, and the §2b parent-duty pointer (the workflow section already says it).

1.4.9 — 2026-09-20

• Pass 0 coverage: every in-scope path is reviewed or skipped with a reason. Silent omit is a review defect. Unread HIGH hunks cannot PASS on structure.
• Review units: cluster related changed files (impl+test, handler+service, i18n twins) before line-by-line. Pincer still opens unchanged callees.
• §2b: HIGH second pass hunts new files/journeys (a first-pass plan is a coverage ceiling); do not verdict after the first [must-fix].
• Pre-send: drop a finding only when the change set proves it wrong (unsure → keep); unanchored behavioral blockers do not ship.
• Size: dropped the Pass-overview table (duplicate of TL;DR), Pass 3 primary questions (duplicate of the blocker table), Faster-merge Q7 (covered by empirical + reversibility), and a few restated asides. No rule removed except the small-diff tip (advice, not a gate).
• Sources: Alibaba Open Code Review (coverage / grouping / fact-check methods). Dropped Giacomelli (the small-diff sentence is gone).

1.4.8 — 2026-09-01

• Live-path gate (§2b) runs before any [must-fix], not only HIGH — MEDIUM stretched [authz] no longer skips it.
• [authz] capability-token carve-out: lookup by a token the client cannot mint is not IDOR unless the review shows an attacker-controlled way to present it; else Advisory [latent_contract]. Noise filter now says proven [authz].
• Pass 3 #1 is deletion of a layer/branch. Extracting a shared helper is Advisory / Code judo, not a presumptive blocker (and not #5).
• Pre-send: keyspace claims must show bit-width arithmetic; third-party “will 400 / model does not exist” without a current-docs cite → [unverified_claim].

1.4.7 — 2026-08-26

• Portable default laws (Pass 1, changed files only): [authz] (IDOR / client-only filter / open storage rules / hardcoded secrets), [slopsquat] (new dep missing from lockfile, unresolved, or near-typo), [instruction_injection] (hidden operator text in agent config — Advisory until a live path).
• Noise filter (verdict hygiene): speculative DoS, rate-limits, open-redirect without a session steal, memory/CPU exhaustion, unproven input-validation stay off BLOCKERS.
• Pass 0: size does not set risk tier; lockfiles in-scope only as evidence for unresolved new deps.
• Pass 3: name throwaway-code / piecemeal-growth anti-patterns (same bar, not new blocker rows). Distinct from #12 (product-LLM user input).
• Sources: xda + vietanh (authz / slopsquat); Anthropic claude-code-security-review (noise filter + IDOR taxonomy); Big Ball of Mud (named anti-patterns).

1.4.6 — 2026-08-25

• Overlay law shape: when a repo overlay states a law as path glob + what to flag + what you want instead, apply it to changed files matching the glob and quote the law under the finding. Unstructured overlay text still counts if it is enforceable. A sentence of good intentions is not a law.
• PASS veto: open product / API-shape / irreversible-data judgement ([needs_judgement]) cannot be PASS even when structure is clean. Style, copy, and docs nits do not by themselves block PASS. HIGH still never PASS on structure alone.
• README: authoring examples for REVIEWS.md laws.
• Sources: Sourcery (review-rule shape + “needs a person's judgement”) — methods only, not their bot or scanner.

1.4.5 — 2026-08-13

• Pass 1: name user journeys at risk, not only files / blast-radius labels.
• Verification gap tokens: covered | adjacent-only | named-unrun | none. Default named-unrun when checks are listed but not executed in this review.
• Live-path gate: failure modes already on the base branch and not newly exposed by this diff → Advisory [preexisting], not a blocker.
• Behavioral blockers: given / when / then repro plus a live path this diff can reach. Structural blockers still cite a line only.
• Empirical checks: on MEDIUM+ user-facing diffs, name at least one check per at-risk journey. Still do not run (or spin up the app) unless the user asked.
• Sources: Ito (execution-based PR review) — methods only, not their sandbox.

1.4.4 — 2026-08-11

• Pass 1: add Reversibility and Verification gap questions (hard rollback / green-CI-without-coverage raise effective risk).
• Sensor contract: queue bots may map LOW+PASS to an approve signal outside the skill — not numeric auto-approve bands inside it.
• Eval reminder: when reviews are logged, sample whether risk tier and recommendation matched human judgment.
• Output template: Reversibility + Verification gap under Review depth.
• Sources: Claire Vo / Merge Mommy (Lenny’s How I AI) + Intercom cite.

1.4.3 — 2026-08-08

• Agent Plugins packaging: add root plugin.json and move the skill payload to skills/unified-code-review/ (SKILL.md, FULL-PINCER.md, SOURCES.md). npx skills add discovery unchanged.
• No rubric changes.

1.4.2 — 2026-08-01

• Presentation ≠ proof / trust–spray (Pass 2): [unverified_claim] for unbacked “tested” claims; burst first-touch PRs need issue-first intent before line-by-line.
• Sources: Kilo — Code Is Cheap. Review Is Expensive.

1.4.1 — 2026-07-30

• Degraded mode for partial installs: if the tier table selects Full but FULL-PINCER.md is unavailable, run Standard and mark the Full tier unverified — same rule as truncated context: never claim coverage you did not read.
• Pass 1 now points forward to the repo overlay (repo REVIEWS.md risk tiers replace the generic examples), so a strict reader does not classify with defaults before learning the repo overrides them.
• README pass table gained the Pass 0 row (establish the change set first).

1.4.0 — 2026-07-30

Heads-up for updaters: the skill is now three files. SKILL.md links to FULL-PINCER.md and SOURCES.md by relative path. npx skills update handles this for you; if you install by hand, copy all three into the same directory or the on-demand links will dangle.

Lighter — 36.2 KB → 24.4 KB (483 → 404 lines), no rule removed. People run this every commit rather than every tenth commit, so per-run context cost matters more than keeping one self-contained file.

• Full-tier pincer harness moved to FULL-PINCER.md, loaded only when the tier table selects Full.
• Provenance moved to SOURCES.md — it was already marked "not required reading for the agent."
• The structure-only tool comparison moved to README.md; it argues tool choice to a human, not to the agent mid-review.
• Table alignment padding stripped: 5.6 KB of whitespace, zero content.
• Four rules that were stated two or three times now have one canonical home plus pointers.

Fixed contradictions a literal reader could act on.

• HIGH risk now defers to the pincer tier table instead of commanding Full while the table said Standard. The table is the single source of tier criteria, and its rows are jointly exhaustive (Standard = MEDIUM or HIGH without wide fan-in; Full = HIGH and wide fan-in).
• §2b (agent-as-reviewer) and §2c (pincer) carry their own triggers. They were nested under "Pass 2 — Agent-authored (when applicable)" even though §2b always applies and §2c depends on wiring, so a human-authored diff could skip both.
• Document order now follows execution order. Pass 1b had been documented before Pass 1, with the tool comparison wedged between them.
• Empirical checks state when to run versus when to recommend, matching the pipeline contract. Two places had told the sensor to execute tests while the header said to emit and stop.
• Verdict tokens are declared once and used identically everywhere. Section-scoped verdicts (Task coverage, reconcile) can no longer be mistaken for the sensor verdict.

Added.

• Pass 0 — establish the change set. Merge-base diff for branch audits (a plain two-dot diff against a moved base silently pulls in unrelated mainline history), gh pr diff for PRs, base/head SHAs recorded in the report. Nothing had told the reviewer how to obtain its own diff.
• Lockfiles, generated output, vendored trees, and spec/task .md files are out of scope for findings unless they encode a code invariant the diff violates.
• Output template split into an always-emitted core block and an add-on block, replacing five per-section "optional" caveats. Empty sections are omitted rather than emitted with placeholders.
• Nits are allowed on ADVISORY, not only PASS.

Repo hygiene. reference/ is ignored via .gitignore instead of a machine-local .git/info/exclude, so the fixture and maintainer notes stay out of the installed pack from every clone. A npx skills add <owner>/<repo> install ships only git-tracked files.

1.3.3 was prepared but never published; its changes are included above.

1.3.2 — 2026-07-27

Pipeline contract: Advisory and Nits are for humans to triage. Agent fix loops act only on Blockers unless the user asks otherwise, so autofix pipelines stop implementing advisories unprompted.

1.3.1 — 2026-07-27

Hardening for smaller / faster models: consistency lock between verdict and Blockers, pre-send checklist, and the live-path gate — a [must-fix] on a helper or validator needs at least one production call site, otherwise it is Advisory [latent_contract].

1.3.0 — 2026-07-27

Optional fresh-context review when the same session authored the diff: dispatch a subagent or new thread with a review package (risk summary, SHAs, overlay pointers) rather than session history.

1.2.0 — 2026-07-26

Pass 2 gains the example-bound fix check ([example_bound_fix]) and the optional decision audit for MEDIUM+ agent-authored changes.

1.1.0 — 2026-07-25

First public release: MIT license, skill frontmatter with trigger phrases, README problem framing.