feat(0.20.0): bstack cross-review CLI — restore P20 mechanism (BRO-1227 Fix B)#51
Merged
Merged
Conversation
…27 Fix B)
Closes the cross-vendor adversarial review gap that surfaced during the
2026-05-21 Wave 3 dispatch: both Cato sub-agent invocations stalled within
6-7 tool uses with path-resolution errors, because they tried to Read
files from the local working tree while it was on a different branch
than the PR's head SHA.
Fix B (this PR) reads PR contents via `gh pr diff` + `gh api
repos/.../contents/<path>?ref=<sha>`. Working-tree state is eliminated as
a variable — invokable from any cwd; only --repo + PR number matter.
## P14 dep-chain
Upstream:
- bin/bstack (dispatcher) — adds cross-review case
- scripts/cross-review.py — new Python module
- bin/bstack-cross-review — new shim (mirrors bstack-wave pattern)
- gh CLI — must be installed + authenticated (fail-fast if absent)
- codex CLI — optional; graceful degradation to verdict=skipped if missing
Downstream:
- broomva/cross-review skill at ~/.claude/skills/cross-review/ — Fix C
follow-up; this PR is the substrate
- ~/.claude/agents/Cato.md — still callable independently; this CLI is
the recommended path for PR-scoped review
- All future P20-required PRs (auth, crypto, infra)
- broomva.tech#195, #196 + life#1427 — retro-review queue (post-merge);
use `bstack cross-review <N> --repo <owner/name> --post-comment` to
attach verdicts
## P11 validation gates executed
bash -n bin/bstack bin/bstack-cross-review # syntax OK
python3 -m py_compile scripts/cross-review.py # OK
bin/bstack --help | grep cross-review # 2 lines surface
bin/bstack cross-review --help # argparse usage
bin/bstack cross-review 195 --repo broomva/broomva.tech --dry-run
→ 9 files fetched (8 real + 1 lock skipped), diff 53039 bytes
bash tests/cross-review.test.sh # 8/8 pass
End-to-end smoke (codex exec network bound) — operator-driven; the CLI
emits verdict=skipped with the codex-missing reason when codex is
unavailable, so the gate is observable not silent.
## What this PR does NOT do
- Apply the new CLI to the 3 retro-review PRs (#195, #196, life#1427).
That's a follow-up — no code change needed.
- Ship the full Fix C ~/.claude/skills/cross-review/ skill repo + Cato
re-architecture. Larger blast radius; deferred until Fix B soaks ≥3
P20 invocations.
## Why Fix B over A or C
A: --cwd parameter to Cato. Leaves working-tree coupling intact;
failure mode returns next time someone Cato's across repos.
B (this PR): always read from git via gh. Eliminates the failure mode by
construction.
C: full skill + agent + tmp-checkout pipeline. Complete answer but
larger blast radius. Deferred to a follow-up.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
Warning Review limit reached
Your plan currently allows 1 review/hour. Refill in 10 minutes and 18 seconds. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more review capacity refills, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than trial, open-source, and free plans. In all cases, review capacity refills continuously over time. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (7)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
bstack cross-review <pr-num> --repo <owner/name>— a CLI that performs cross-vendor adversarial review of a GitHub PR by reading content viagh pr diff+gh api …/contents/<path>?ref=<sha>. Working-tree state is eliminated as a variable — the CLI works from any cwd; only--repo+ PR number matter.Readfiles from the local working tree, which was on a different branch than the PR's head SHA. The agents drifted into "let me locate the actual repo" loops and never produced output.verdict(pass/concerns/fail/skipped) ×anti_slop_score(0-10) ×criticality(high/medium/low) ×findings[]×blind_spots_surfaced[]×summary. Anti-slop score ≥7/10 required forpass. Exit codes 0/10/20/30 (pass/concerns/fail/skipped); 2 on invocation/gh failure.What ships
scripts/cross-review.py(~340 LOC) — argparse CLI, the Python modulebin/bstack-cross-review(16 LOC) — thin shim mirroringbin/bstack-wavetests/cross-review.test.sh(8 tests) — hermetic offline smokebin/bstack— addscross-review)dispatch + usage/Examples entriesSKILL.md— Quick start lists the new subcommandVERSION—0.19.0 → 0.20.0CHANGELOG.md— full 0.20.0 entryP14 dep-chain
Upstream:
ghCLI (required; fail-fast if absent),codexCLI (optional; graceful degradation toverdict=skippedif missing), Python 3.8+ (stdlib only),bin/bstackdispatcher,~/broomva/bstack/scripts/directory, BRO-1227 (this PR's ticket).Downstream:
broomva/cross-reviewskill at~/.claude/skills/cross-review/(currently absent — Fix C scope, deferred follow-up)~/.claude/agents/Cato.md— still callable independently; this CLI is the recommended path for PR-scoped reviewbroomva.tech#195,broomva.tech#196,life#1427— three PRs that merged last session without P20. Post-mergebstack cross-review <N> --repo <owner/name> --post-commentwill attach verdicts; not in this PR.P11 validation executed
```
bash -n bin/bstack bin/bstack-cross-review # syntax OK
python3 -m py_compile scripts/cross-review.py # OK
bin/bstack --help | grep cross-review # 2 lines surface
bin/bstack cross-review --help # argparse usage
bin/bstack cross-review 195 --repo broomva/broomva.tech --dry-run # 9 files (8 real + 1 lock skipped)
bash tests/cross-review.test.sh # 8/8 pass
```
End-to-end smoke (codex exec network-bound): deferred to operator-driven first invocation. The CLI emits
verdict=skippedwith the codex-missing reason when codex is unavailable, so the gate is observable, not silent.Why Fix B (not A or C)
--cwdparameter to Cato dispatch) leaves the working-tree-state coupling intact. Failure mode returns next time someone Catos across repos.gh, never the working tree) eliminates the failure mode by construction.~/.claude/skills/cross-review/skill + Cato re-architecture + tmp-checkout pipeline) is the complete answer but larger blast radius. Deferred until Fix B has soaked through ≥3 P20 invocations.P20 status on this PR
This PR ships the P20 mechanism itself, so a self-referential bootstrap exemption applies: the new CLI cannot review its own merge (the binary doesn't yet exist on
main). Manual P20 via the broken Cato path is exactly the failure this PR fixes. Once merged, future PRs can usebstack cross-reviewagainst this PR retrospectively if desired.What this PR does NOT do
broomva.tech#195,#196,life#1427). That's a follow-up — no code change needed; just CLI invocations against existing merged PRs.~/.claude/skills/cross-review/skill repo + Cato re-architecture. Larger blast radius; deferred.Test plan checklist
bash -n bin/bstack-cross-reviewsyntax checkpython3 -m py_compile scripts/cross-review.pysyntax checkbin/bstack --helplistscross-reviewbin/bstack cross-review --helpreturns argparse usagebin/bstack cross-review 195 --repo broomva/broomva.tech --dry-runfetches 9 filesbash tests/cross-review.test.sh— 8/8 passbin/bstack cross-review 195 --repo broomva/broomva.techagainst a real PR with codex installed (operator-driven post-merge)Backreferences
/Users/broomva/conductor/archived-contexts/broomva/wave-3-dispatch-and-linear-updates/handoffs/2026-05-22-SESSION-HANDOFF.md§"Queued + ready to dispatch"🤖 Generated with Claude Code