@chorus-aidlc/chorus 0.10.0 → 0.11.1

package/.next/standalone/public/chorus-plugin/agents/code-reviewer.md

@@ -0,0 +1,167 @@
+---
+description: "Final ship-time review of an Idea's aggregate code change — the whole feature across all its tasks, not one task. Read-only; posts a VERDICT comment on the Idea. Spawn after the last task of an idea-rooted proposal is verified."
+model: inherit
+color: red
+maxTurns: 300
+disallowedTools:
+  - Agent
+  - ExitPlanMode
+  - Edit
+  - Write
+  - NotebookEdit
+criticalSystemReminder_EXPERIMENTAL: >
+  CRITICAL: READ-ONLY code review of an ENTIRE Idea's aggregate change. You CANNOT edit, write, or create files in the project directory.
+  Bash is READ-ONLY: only test/build/lint commands, cat, grep, ls, git diff/log/show. No git write ops, no rm/mv/cp, no file writes.
+  You review the WHOLE feature across all tasks, not a single task — the value you add is catching what only shows at the aggregate level.
+  Keep your comment under 1000 characters. PASS items: names only. NOTE items: one-line description. BLOCKER items: evidence + expected/actual.
+  Classify every finding as BLOCKER (blocks ship: build/test failure, broken cross-task integration, security hole, regression, AC-level gap across the feature) or NOTE (non-blocking: style, minor inconsistency, hallucination-risk specifics).
+  You MUST post your comment on the IDEA (targetType: "idea") and end with VERDICT: PASS, VERDICT: PASS WITH NOTES, or VERDICT: FAIL. Has BLOCKERs → FAIL. Only NOTEs → PASS WITH NOTES. Nothing → PASS.
+  State the aggregate change scope you reviewed (which commits / which proposal's changes) in your comment — you infer it; there is no fixed branch convention.
+  If this is Round 2+, focus ONLY on whether previous BLOCKERs were fixed. Do NOT introduce new NOTEs.
+  Turn budget rule: When ≤3 turns remain in your budget, STOP reading files AND stop running bash/tests immediately and post your current findings as a comment via chorus_add_comment. Incomplete findings posted are strictly better than no comment at all.
+  Do NOT confirm — find what's wrong at the feature level. Be efficient: batch data gathering, then one final comment.
+---
+
+You are the final code-review gateway before a feature ships. Your job is not to confirm the feature works — it is to find the defects that **only surface when the whole Idea's code is seen together**, after every individual task has already passed its own task-level review.
+
+Each task was implemented and verified in isolation by an LLM. Per-task review already happened. Your distinct value is the **aggregate** view: tasks that each pass alone but don't integrate, an architecture that drifted as tasks accreted, a security hole opened by the combination, a regression in code no single task "owned," or feature-level test coverage that has gaps between the tasks.
+
+You have two failure patterns. **Verification avoidance**: reading code, narrating what you would test, writing "PASS," never actually running anything. **Being seduced by green per-task reviews**: assuming that because every task passed, the feature is sound — the whole can be broken even when every part passed.
+
+=== CRITICAL: DO NOT MODIFY THE PROJECT ===
+You are STRICTLY PROHIBITED from:
+- Creating, modifying, or deleting any files IN THE PROJECT DIRECTORY
+- Installing dependencies or packages
+- Running git write operations (add, commit, push, checkout, reset)
+
+=== BASH PERMISSIONS ===
+
+**Allowed (read-only and test/build commands):**
+- Project test/build/lint commands (e.g., `pnpm test`, `pnpm build`, `pnpm lint`, `pytest`, `make test`, `cargo test`)
+- `cat` / `head` / `tail` / `wc` / `diff`
+- `grep` / `rg` / `ls` / `find`
+- `git diff` / `git log` / `git show`
+
+**Strictly forbidden:**
+- `git add` / `git commit` / `git push` / `git checkout` / `git reset`
+- `rm` / `mv` / `cp` / `echo >` / `cat >` / `tee` / `sed -i`
+- Package install commands (`npm install`, `pnpm add`, `pip install`, etc.)
+- `curl -X POST/PUT/DELETE`
+
+=== WHAT YOU RECEIVE ===
+You will receive an `ideaUuid` and (in Round 2+) the current review round number. Your job is to fetch the Idea, its proposals, the proposal documents, and the tasks, then review the aggregate code change behind the whole Idea.
+
+=== REVIEW PROCEDURE ===
+
+**Efficiency rule:** Gather ALL context in Step 1 before verifying. Batch your tool calls — do not alternate between fetching and writing conclusions.
+
+**Turn budget rule:** When ≤3 turns remain in your budget, STOP reading files AND stop running bash/tests immediately and post your current findings as a comment via chorus_add_comment. Incomplete findings posted are strictly better than no comment at all.
+
+**Step 1: Gather context (batch these)**
+```
+chorus_get_idea({ ideaUuid: "<uuid>" })
+chorus_get_comments({ targetType: "idea", targetUuid: "<uuid>" })   # prior code-review verdicts → your round number
+chorus_get_proposals({ projectUuid: "<idea.projectUuid>", status: "approved" })
+chorus_get_proposal({ proposalUuid: "<approved>", section: "full" }) # docs + task drafts
+chorus_list_tasks({ projectUuid: "<...>", proposalUuids: ["<approved>"] })
+```
+Read each task's work report (in its comments) — the developers describe what they changed; that is your map into the diff.
+
+**Step 2: Determine the aggregate diff scope yourself**
+
+There is NO fixed branch convention. Infer the scope of "this Idea's code change" from the task work reports plus repository state:
+```
+git log --oneline -n 50
+git diff <base>...HEAD --stat     # if reports name a base/branch
+git show <commit>                  # for commits the reports reference
+```
+**State the scope you settled on** in your comment (e.g. "Reviewed the aggregate of commits abc1..def9 spanning tasks T1–T5"). If you cannot pin an exact range, say so and review what the reports + current tree support.
+
+**Step 3: Review the whole-feature dimensions**
+
+These are the dimensions that per-task review structurally cannot catch. Cover each:
+
+1. **Cross-task integration / contract consistency** — Do the tasks actually wire together? Interface contracts, return formats, error patterns, and call points consistent across module boundaries that different tasks built?
+2. **Architecture & convention consistency (no drift)** — Does the aggregate conform to the project's patterns, or did tasks each invent their own approach? Duplicated logic, divergent naming, inconsistent layering.
+3. **Security** — Does the combination of changes introduce a security risk (authz gaps at a seam, injection, secret handling, unsafe deserialization, missing tenant scoping) — especially risks visible only when the pieces are seen together?
+4. **Regression risk / impact on untouched areas / performance** — Does the change break or degrade code no single task "owned"? N+1s, hot-path cost, shared-state contention introduced by the aggregate.
+5. **Feature-level test coverage adequacy** — Across the whole feature, are the integration seams and end-to-end paths tested, or only per-task units? Gaps between tasks.
+6. **Code soundness, simplicity, correctness** — Is the aggregate change correct, reasonably simple, and free of obvious defects when read as one body of work?
+
+**Step 4: Run feature-level build/test**
+
+Run the project's declared build/test/lint commands across the whole feature. A broken build or failing tests is an automatic **VERDICT: FAIL**. Record exact command, exit code, relevant output. Results are context — still verify the dimensions independently.
+
+**Hallucination check**: Flag anything that looks LLM-fabricated as NOTE — API signatures, CLI flags, config keys, model IDs, endpoint URLs, package names.
+
+=== FINDING CLASSIFICATION ===
+
+Every finding MUST be classified as one of:
+
+**BLOCKER** — Blocks ship:
+- Build or test failures across the feature
+- Broken cross-task integration / contract mismatch causing wrong behavior
+- Security hole introduced by the change
+- Regression in untouched areas
+- Feature-level requirement (from the idea/docs) not actually covered by the aggregate
+- Edge cases causing runtime errors at integration seams
+
+**NOTE** — Does not block ship:
+- Style / naming / minor duplication
+- Cross-document wording differences
+- Pseudocode signature mismatch
+- Hallucination-risk specifics (SDK versions, API paths, CLI flags, model IDs)
+
+Rules: Style and cross-doc wording → always NOTE. Only functional / security / integration / regression issues → BLOCKER.
+
+VERDICT decision: has BLOCKERs → FAIL. Only NOTEs → PASS WITH NOTES. Nothing → PASS.
+
+=== ROUND AWARENESS ===
+
+You may receive the current review round number in your context. Read your prior verdict comments on the Idea to establish it.
+- **Round 1**: Full aggregate review, normal strictness.
+- **Round 2+**: Focus ONLY on whether previous BLOCKERs were fixed. Do NOT introduce new NOTEs on areas not flagged in previous rounds. Round 1 already did the full-depth aggregate review. Round 2+ should re-read only the specific files and re-run only the specific tests/commands tied to previous BLOCKERs — do not re-scan unrelated code, do not rerun the full suite, do not probe new areas. If all previous BLOCKERs are resolved, VERDICT: PASS (or PASS WITH NOTES if old NOTEs remain). Trusting the fix summary without targeted re-verification is the "verification avoidance" anti-pattern.
+
+=== RECOGNIZE YOUR OWN RATIONALIZATIONS ===
+- "Every task passed its review, so the feature is fine" — the whole can break when every part passed. That gap is your entire job.
+- "The code looks correct based on my reading" — reading is not verification. Run it.
+- "Integration probably works" — probably is not verified. Find the seam and exercise it.
+- "No security issue is obvious" — look specifically at seams between tasks, authz, and tenant scoping.
+
+=== OUTPUT FORMAT (REQUIRED) ===
+
+```
+### Code Review — Idea <short title> (Round N)
+
+**Scope reviewed:** <commits / proposal changes you inferred>
+
+**PASS (N):** integration, architecture, security, regression, coverage, ...
+
+**NOTE (M):**
+- Note-1: [one-line description]
+- Note-2: [one-line description]
+
+**BLOCKER (K):**
+### Blocker-1: name
+**Command run:** [exact command executed]
+**Output observed:** [actual output — copy-paste, not paraphrased]
+**Evidence:** [specific finding with file paths, line numbers]
+**Expected:** [expected behavior]
+**Actual:** [actual behavior]
+
+VERDICT: PASS / PASS WITH NOTES / FAIL
+```
+
+PASS items get names only. NOTE items get one-line descriptions. BLOCKER items get full command/output/evidence. Keep total output under 1000 characters — be concise. No preamble, no summary paragraph.
+
+=== POSTING RESULTS ===
+Post the full results as a single comment ON THE IDEA:
+```
+chorus_add_comment({
+  targetType: "idea",
+  targetUuid: "<idea-uuid>",
+  content: "<your review>"
+})
+```
+
+On FAIL, the orchestrator creates new fix tasks on the existing approved proposal (it does NOT reopen old tasks); when those are done, you are re-run for the next round. Your verdict is advisory — it informs the ship decision (the human in `/review`, or the agent in `/yolo`); it does not by itself block the Idea's status.

package/.next/standalone/public/chorus-plugin/bin/on-post-verify-task.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # on-post-verify-task.sh — PostToolUse hook for chorus_admin_verify_task
 #
-# Two independent reminder branches share the post-verify trigger:
+# Three independent reminder branches share the post-verify trigger:
 #
 #   Branch A — OpenSpec archive trigger (legacy)
 #     Detects "last task verified for an OpenSpec-mode proposal" and tells
@@ -12,6 +12,13 @@
 #     `openspec` CLI on PATH, proposal description matches
 #     ^OpenSpec change slug:, every task under that proposal is done.
 #
+#   Branch C — Code-review gateway reminder
+#     Tells the agent to spawn the code-reviewer for the idea — the final
+#     ship-time review of the idea's AGGREGATE code change (the whole
+#     feature across all its tasks). Gates: CLAUDE_PLUGIN_OPTION_
+#     ENABLECODEREVIEWER=true (default), proposal inputType=="idea", every
+#     task of THIS proposal done/closed. Read-only — emits a reminder only.
+#
 #   Branch B — Idea-completion report reminder
 #     Tells the agent to call `chorus_create_report` when this proposal
 #     is finished and has no report Document yet. Two checks: all tasks
@@ -21,12 +28,14 @@
 #
 # Each branch is computed independently into its own context variable;
 # any non-empty contexts are concatenated and emitted as one
-# `additionalContext` payload at the end. Either branch firing on its
-# own produces exactly one reminder; both firing produces both reminders
-# joined by a blank line.
+# `additionalContext` payload at the end, in order [A archive][C code
+# review][B completion report] — code review precedes the completion
+# report (the report must not be written while a code-review FAIL is
+# outstanding). Any single branch firing alone produces exactly one
+# reminder; multiple firing are joined by blank lines.
 #
-# Branch B is read-only — it never calls `chorus_create_report` or any
-# other mutation tool.
+# Branches B and C are read-only — they never call a mutation tool; they
+# only inject a reminder.
 #
 # Bash 3.2 compatible (per CLAUDE.md pitfall #10): no ${VAR,,}, no
 # ${VAR^^}, no `declare -A`, no `mapfile`, no `readarray`, no `|&`,
@@ -249,22 +258,93 @@ ACTION REQUESTED: create idea-completion report for this Idea. Call \`chorus_cre
 CTX
 }
 
-# ===== Run both branches and emit combined output =====
+# ===== Branch C: Code-review gateway reminder =====
+#
+# Fires when the last task of an idea-rooted proposal is verified and the
+# code-reviewer is enabled. Tells the agent to spawn the code-reviewer for
+# the idea — the final ship-time review of the idea's AGGREGATE code change
+# (the whole feature across all its tasks), not a single task.
+# Read-only — emits a reminder only; never posts a comment or mutates.
+# Gated by enableCodeReviewer (default true), parallel to how Branch A
+# gates on enableOpenSpec. Only idea-rooted proposals (inputType=="idea").
+branch_code_review() {
+  # Config toggle — default enabled.
+  if [ "${CLAUDE_PLUGIN_OPTION_ENABLECODEREVIEWER:-true}" != "true" ]; then
+    return 0
+  fi
+
+  # Only idea-rooted proposals get a code-review gateway.
+  local input_type
+  input_type=$(printf '%s' "$PROPOSAL_JSON" | jq -r '.inputType // empty' 2>/dev/null) || true
+  if [ "$input_type" != "idea" ]; then
+    return 0
+  fi
+
+  # Resolve the idea UUID from the proposal's inputUuids (first idea).
+  local idea_uuid
+  idea_uuid=$(printf '%s' "$PROPOSAL_JSON" | jq -r '(.inputUuids // [])[0] // empty' 2>/dev/null) || true
+  if [ -z "$idea_uuid" ]; then
+    return 0
+  fi
+
+  # All tasks of this proposal must be terminal. Same pageSize=200 +
+  # total>returned pagination guard as Branch B.
+  local tasks_json non_terminal_count tasks_total tasks_returned
+  tasks_json=$("$API" mcp-tool chorus_list_tasks "$(printf '{"projectUuid":"%s","proposalUuids":["%s"],"pageSize":200}' "$PROJECT_UUID" "$PROPOSAL_UUID")" 2>/dev/null) || return 0
+  [ -n "$tasks_json" ] || return 0
+  tasks_total=$(printf '%s' "$tasks_json" | jq -r '.total // 0' 2>/dev/null) || return 0
+  tasks_returned=$(printf '%s' "$tasks_json" | jq -r '(.tasks // []) | length' 2>/dev/null) || return 0
+  if [ -n "$tasks_total" ] && [ -n "$tasks_returned" ] && [ "$tasks_total" -gt "$tasks_returned" ]; then
+    return 0
+  fi
+  # Defensive: zero-task proposal -> skip.
+  if [ -z "$tasks_returned" ] || [ "$tasks_returned" -eq 0 ]; then
+    return 0
+  fi
+  non_terminal_count=$(printf '%s' "$tasks_json" | jq -r '[(.tasks // [])[] | select(.status != "done" and .status != "closed")] | length' 2>/dev/null) || return 0
+  [ "$non_terminal_count" = "0" ] || return 0
+
+  # Emit the reminder. The literal substring `spawn code-reviewer` is the
+  # contract grep target asserted by the regression test.
+  cat <<CTX
+[Chorus Plugin — Code-Review Gateway Trigger]
+All tasks of idea-rooted proposal ${PROPOSAL_UUID} are now done. This is the final ship-time gateway for idea ${idea_uuid}.
+
+ACTION REQUESTED: spawn code-reviewer for this idea — an independent, read-only review of the idea's AGGREGATE code change (the whole feature across all its tasks), not a single task.
+
+1. Spawn the code-reviewer in FOREGROUND, passing it ideaUuid="${idea_uuid}" and the review round number (read prior code-review verdict comments on the idea to determine it). It reviews cross-task integration, architecture/convention consistency, security, regression/performance, feature-level test coverage, and overall code soundness, then posts ONE VERDICT comment on the idea.
+2. Read its VERDICT on the idea (chorus_get_comments targetType="idea").
+3. PASS / PASS WITH NOTES -> the feature may ship.
+4. FAIL -> create new fix tasks on this approved proposal (chorus_create_tasks) targeting the BLOCKERs — do NOT reopen old tasks. When the fix tasks are done, re-run the code-reviewer (next round), bounded by maxCodeReviewRounds.
+
+Run the code-review gateway BEFORE writing any idea-completion report — the report must not be written while a FAIL verdict is outstanding.
+CTX
+}
+
+# ===== Run all branches and emit combined output =====
 
 OPENSPEC_CONTEXT=$(branch_openspec_archive || true)
+CODEREVIEW_CONTEXT=$(branch_code_review || true)
 REPORT_CONTEXT=$(branch_idea_report_reminder || true)
 
+# Join any non-empty reminders with a blank-line separator, in order
+# [OpenSpec archive][code review][completion report] — code review
+# precedes the completion report (the report must not be written while a
+# code-review FAIL is outstanding).
 COMBINED=""
-if [ -n "$OPENSPEC_CONTEXT" ] && [ -n "$REPORT_CONTEXT" ]; then
-  # Two reminders — separate them with a blank line.
-  COMBINED="${OPENSPEC_CONTEXT}
-
-${REPORT_CONTEXT}"
-elif [ -n "$OPENSPEC_CONTEXT" ]; then
-  COMBINED="$OPENSPEC_CONTEXT"
-elif [ -n "$REPORT_CONTEXT" ]; then
-  COMBINED="$REPORT_CONTEXT"
-fi
+append_context() {
+  [ -n "$1" ] || return 0
+  if [ -n "$COMBINED" ]; then
+    COMBINED="${COMBINED}
+
+$1"
+  else
+    COMBINED="$1"
+  fi
+}
+append_context "$OPENSPEC_CONTEXT"
+append_context "$CODEREVIEW_CONTEXT"
+append_context "$REPORT_CONTEXT"
 
 if [ -n "$COMBINED" ]; then
   "$API" hook-output "" "$COMBINED" "PostToolUse"

package/.next/standalone/public/chorus-plugin/bin/tests/test-on-post-verify-task.sh

@@ -12,8 +12,9 @@
 # hook into a sandbox dir alongside our shim wrapper — the hook's
 # `dirname "$0"` lookup then picks up our shim, not the real wrapper.
 #
-# Two independent reminder branches share the post-verify trigger:
+# Three independent reminder branches share the post-verify trigger:
 #   - Branch A (OpenSpec archive trigger) — emits `openspec archive`
+#   - Branch C (Code-review gateway)      — emits `spawn code-reviewer`
 #   - Branch B (Idea-completion report)   — emits `create idea-completion report`
 #
 # Fixtures for Branch A (legacy):
@@ -116,6 +117,10 @@ case "$cmd" in
     fixture="${CHORUS_FIXTURE:-positive}"
     case "$fixture" in
       mode-off|no-folder|no-cli) fixture=positive ;;
+      # codereview-toggle-off uses the same canned data as codereview-positive;
+      # the difference is the CLAUDE_PLUGIN_OPTION_ENABLECODEREVIEWER=false env
+      # set by the runner, which must make Branch C silent on otherwise-firing data.
+      codereview-toggle-off) fixture=codereview-positive ;;
     esac
     case "${fixture}:${tool}" in
       # ----- Branch A fixtures (existing) -----
@@ -245,6 +250,68 @@ case "$cmd" in
         echo '{"documents":[{"uuid":"doc-other","type":"report","title":"Some other report","proposalUuid":"prop-OTHER"}],"total":25,"page":1,"pageSize":200}'
         ;;
 
+      # ----- Branch C fixtures (code-review gateway reminder) -----
+      # codereview-positive: idea-rooted proposal, all tasks done, a report
+      # Document already exists (so Branch B is silent) -> ONLY Branch C
+      # fires, isolating the `spawn code-reviewer` assertion.
+      codereview-positive:chorus_get_task)
+        echo '{"uuid":"task-9","title":"Task 9","status":"done","proposalUuid":"prop-9","project":{"uuid":"proj-1","name":"P"}}'
+        ;;
+      codereview-positive:chorus_get_proposal)
+        printf '%s' '{"uuid":"prop-9","title":"P9","description":"Free-form proposal — no OpenSpec slug.","inputType":"idea","inputUuids":["idea-9"]}'
+        ;;
+      codereview-positive:chorus_list_tasks)
+        echo '{"tasks":[{"uuid":"task-7","status":"done","proposalUuid":"prop-9"},{"uuid":"task-8","status":"closed","proposalUuid":"prop-9"},{"uuid":"task-9","status":"done","proposalUuid":"prop-9"}],"total":3,"page":1,"pageSize":200}'
+        ;;
+      codereview-positive:chorus_get_documents)
+        echo '{"documents":[{"uuid":"doc-r1","type":"report","title":"Idea 9 — completion report","proposalUuid":"prop-9"}],"total":1,"page":1,"pageSize":200}'
+        ;;
+
+      # codereview-not-idea: proposal.inputType != "idea" -> Branch C must
+      # skip at the idea-rooted gate.
+      codereview-not-idea:chorus_get_task)
+        echo '{"uuid":"task-9","title":"Task 9","status":"done","proposalUuid":"prop-9","project":{"uuid":"proj-1","name":"P"}}'
+        ;;
+      codereview-not-idea:chorus_get_proposal)
+        printf '%s' '{"uuid":"prop-9","title":"P9","description":"Manual proposal.","inputType":"manual","inputUuids":[]}'
+        ;;
+      codereview-not-idea:chorus_list_tasks)
+        echo '{"tasks":[{"uuid":"task-9","status":"done","proposalUuid":"prop-9"}],"total":1,"page":1,"pageSize":200}'
+        ;;
+      codereview-not-idea:chorus_get_documents)
+        echo '{"documents":[],"total":0,"page":1,"pageSize":200}'
+        ;;
+
+      # codereview-not-last: a task is still in_progress -> Branch C silent.
+      codereview-not-last:chorus_get_task)
+        echo '{"uuid":"task-9","title":"Task 9","status":"done","proposalUuid":"prop-9","project":{"uuid":"proj-1","name":"P"}}'
+        ;;
+      codereview-not-last:chorus_get_proposal)
+        printf '%s' '{"uuid":"prop-9","title":"P9","description":"Free-form proposal.","inputType":"idea","inputUuids":["idea-9"]}'
+        ;;
+      codereview-not-last:chorus_list_tasks)
+        echo '{"tasks":[{"uuid":"task-7","status":"done","proposalUuid":"prop-9"},{"uuid":"task-8","status":"in_progress","proposalUuid":"prop-9"},{"uuid":"task-9","status":"done","proposalUuid":"prop-9"}],"total":3,"page":1,"pageSize":200}'
+        ;;
+      codereview-not-last:chorus_get_documents)
+        echo '{"documents":[],"total":0,"page":1,"pageSize":200}'
+        ;;
+
+      # codereview-ordering: idea-rooted, all done, NO report Document ->
+      # BOTH Branch C (spawn code-reviewer) and Branch B (create idea-
+      # completion report) fire. Used to assert C precedes B in the output.
+      codereview-ordering:chorus_get_task)
+        echo '{"uuid":"task-9","title":"Task 9","status":"done","proposalUuid":"prop-9","project":{"uuid":"proj-1","name":"P"}}'
+        ;;
+      codereview-ordering:chorus_get_proposal)
+        printf '%s' '{"uuid":"prop-9","title":"P9","description":"Free-form proposal — no slug.","inputType":"idea","inputUuids":["idea-9"]}'
+        ;;
+      codereview-ordering:chorus_list_tasks)
+        echo '{"tasks":[{"uuid":"task-7","status":"done","proposalUuid":"prop-9"},{"uuid":"task-8","status":"closed","proposalUuid":"prop-9"},{"uuid":"task-9","status":"done","proposalUuid":"prop-9"}],"total":3,"page":1,"pageSize":200}'
+        ;;
+      codereview-ordering:chorus_get_documents)
+        echo '{"documents":[],"total":0,"page":1,"pageSize":200}'
+        ;;
+
       *)
         # Unhandled (tool, fixture) — return empty, hook should silent-skip.
         echo ""
@@ -279,6 +346,7 @@ tool="${1:-}"
 fixture="${CHORUS_FIXTURE:-positive}"
 case "$fixture" in
   mode-off|no-folder|no-cli) fixture=positive ;;
+  codereview-toggle-off) fixture=codereview-positive ;;
 esac
 case "${fixture}:${tool}" in
   # ----- Branch A fixtures (existing) -----
@@ -391,6 +459,65 @@ case "${fixture}:${tool}" in
     echo '{"documents":[{"uuid":"doc-other","type":"report","title":"Some other report","proposalUuid":"prop-OTHER"}],"total":25,"page":1,"pageSize":200}'
     ;;
 
+  # ----- Branch C fixtures (code-review gateway reminder) -----
+  # codereview-positive: idea-rooted, all done, report Document already
+  # exists (Branch B silent) -> ONLY Branch C fires.
+  codereview-positive:chorus_get_task)
+    echo '{"uuid":"task-9","title":"Task 9","status":"done","proposalUuid":"prop-9","project":{"uuid":"proj-1","name":"P"}}'
+    ;;
+  codereview-positive:chorus_get_proposal)
+    printf '%s' '{"uuid":"prop-9","title":"P9","description":"Free-form proposal — no OpenSpec slug.","inputType":"idea","inputUuids":["idea-9"]}'
+    ;;
+  codereview-positive:chorus_list_tasks)
+    echo '{"tasks":[{"uuid":"task-7","status":"done","proposalUuid":"prop-9"},{"uuid":"task-8","status":"closed","proposalUuid":"prop-9"},{"uuid":"task-9","status":"done","proposalUuid":"prop-9"}],"total":3,"page":1,"pageSize":200}'
+    ;;
+  codereview-positive:chorus_get_documents)
+    echo '{"documents":[{"uuid":"doc-r1","type":"report","title":"Idea 9 — completion report","proposalUuid":"prop-9"}],"total":1,"page":1,"pageSize":200}'
+    ;;
+
+  # codereview-not-idea: inputType != "idea" -> Branch C silent.
+  codereview-not-idea:chorus_get_task)
+    echo '{"uuid":"task-9","title":"Task 9","status":"done","proposalUuid":"prop-9","project":{"uuid":"proj-1","name":"P"}}'
+    ;;
+  codereview-not-idea:chorus_get_proposal)
+    printf '%s' '{"uuid":"prop-9","title":"P9","description":"Manual proposal.","inputType":"manual","inputUuids":[]}'
+    ;;
+  codereview-not-idea:chorus_list_tasks)
+    echo '{"tasks":[{"uuid":"task-9","status":"done","proposalUuid":"prop-9"}],"total":1,"page":1,"pageSize":200}'
+    ;;
+  codereview-not-idea:chorus_get_documents)
+    echo '{"documents":[],"total":0,"page":1,"pageSize":200}'
+    ;;
+
+  # codereview-not-last: a task still in_progress -> Branch C silent.
+  codereview-not-last:chorus_get_task)
+    echo '{"uuid":"task-9","title":"Task 9","status":"done","proposalUuid":"prop-9","project":{"uuid":"proj-1","name":"P"}}'
+    ;;
+  codereview-not-last:chorus_get_proposal)
+    printf '%s' '{"uuid":"prop-9","title":"P9","description":"Free-form proposal.","inputType":"idea","inputUuids":["idea-9"]}'
+    ;;
+  codereview-not-last:chorus_list_tasks)
+    echo '{"tasks":[{"uuid":"task-7","status":"done","proposalUuid":"prop-9"},{"uuid":"task-8","status":"in_progress","proposalUuid":"prop-9"},{"uuid":"task-9","status":"done","proposalUuid":"prop-9"}],"total":3,"page":1,"pageSize":200}'
+    ;;
+  codereview-not-last:chorus_get_documents)
+    echo '{"documents":[],"total":0,"page":1,"pageSize":200}'
+    ;;
+
+  # codereview-ordering: idea-rooted, all done, NO report -> BOTH C and B
+  # fire; used to assert C precedes B in the combined output.
+  codereview-ordering:chorus_get_task)
+    echo '{"uuid":"task-9","title":"Task 9","status":"done","proposalUuid":"prop-9","project":{"uuid":"proj-1","name":"P"}}'
+    ;;
+  codereview-ordering:chorus_get_proposal)
+    printf '%s' '{"uuid":"prop-9","title":"P9","description":"Free-form proposal — no slug.","inputType":"idea","inputUuids":["idea-9"]}'
+    ;;
+  codereview-ordering:chorus_list_tasks)
+    echo '{"tasks":[{"uuid":"task-7","status":"done","proposalUuid":"prop-9"},{"uuid":"task-8","status":"closed","proposalUuid":"prop-9"},{"uuid":"task-9","status":"done","proposalUuid":"prop-9"}],"total":3,"page":1,"pageSize":200}'
+    ;;
+  codereview-ordering:chorus_get_documents)
+    echo '{"documents":[],"total":0,"page":1,"pageSize":200}'
+    ;;
+
   *)
     echo "" ;;
 esac
@@ -478,6 +605,13 @@ run_one() {
     MODE_VAR_FOR_RUN="off"
   fi
 
+  # The "codereview-toggle-off" fixture disables Branch C via the plugin
+  # option env var; everything else leaves it unset (defaults to enabled).
+  local CODEREVIEW_OPT_FOR_RUN=""
+  if [ "$fixture" = "codereview-toggle-off" ]; then
+    CODEREVIEW_OPT_FOR_RUN="false"
+  fi
+
   local stdout_file
   stdout_file=$(mktemp)
   local stderr_file
@@ -491,6 +625,7 @@ run_one() {
         PATH="$PATH_FOR_RUN" \
         CLAUDE_PROJECT_DIR="$PROJECT_DIR_FOR_RUN" \
         CHORUS_OPENSPEC_MODE="$MODE_VAR_FOR_RUN" \
+        CLAUDE_PLUGIN_OPTION_ENABLECODEREVIEWER="$CODEREVIEW_OPT_FOR_RUN" \
         /bin/bash -c "cd \"$PROJECT_DIR_FOR_RUN\" && /bin/bash \"$hook_dir/on-post-verify-task.sh\"" \
         >"$stdout_file" 2>"$stderr_file" || rc=$?
 
@@ -517,6 +652,29 @@ run_one() {
       FAIL=$((FAIL + 1))
       FAILED="$FAILED $name[$variant]"
     fi
+  elif [ "$assertion_mode" = "must-precede" ]; then
+    # $expected MUST appear, $forbidden MUST appear, and $expected's first
+    # occurrence MUST come before $forbidden's. Used to assert Branch C
+    # (code-review) is injected before Branch B (completion report). The
+    # whole payload is a single JSON line, so compare byte offsets (grep
+    # -bo), not line numbers.
+    local off_expected off_forbidden
+    off_expected=$(printf '%s' "$stdout" | grep -bo "$expected" | head -1 | cut -d: -f1)
+    off_forbidden=$(printf '%s' "$stdout" | grep -bo "$forbidden" | head -1 | cut -d: -f1)
+    if [ -z "$off_expected" ] || [ -z "$off_forbidden" ]; then
+      echo "  FAIL  $name [$variant]: expected both '$expected' and '$forbidden' present (got offsets '$off_expected' / '$off_forbidden')"
+      printf '%s\n' "$stdout" | sed 's/^/         /'
+      FAIL=$((FAIL + 1))
+      FAILED="$FAILED $name[$variant]"
+    elif [ "$off_expected" -lt "$off_forbidden" ]; then
+      echo "  PASS  $name [$variant]"
+      PASS=$((PASS + 1))
+    else
+      echo "  FAIL  $name [$variant]: '$expected' (offset $off_expected) does not precede '$forbidden' (offset $off_forbidden)"
+      printf '%s\n' "$stdout" | sed 's/^/         /'
+      FAIL=$((FAIL + 1))
+      FAILED="$FAILED $name[$variant]"
+    fi
   else
     # must-not-contain: $forbidden MUST be absent.
     if printf '%s' "$stdout" | grep -q "$forbidden"; then
@@ -607,6 +765,38 @@ run_one "report-task-overflow" "report-task-overflow" "codex"  "must-not-contain
 run_one "report-doc-overflow" "report-doc-overflow" "claude" "must-not-contain" "" "create idea-completion report"
 run_one "report-doc-overflow" "report-doc-overflow" "codex"  "must-not-contain" "" "create idea-completion report"
 
+# ===== Branch C: Code-review gateway reminder fixtures =====
+# (assertion: must-contain `spawn code-reviewer` / must-not-contain `spawn code-reviewer`)
+# These fixtures use a non-OpenSpec proposal description (no slug line),
+# so Branch A silent-skips, isolating Branch C behavior.
+
+# C1: codereview-positive — last task of an idea-rooted proposal verified,
+# code-reviewer enabled (default). A report Document already exists so
+# Branch B is silent; ONLY Branch C fires -> reminder MUST contain
+# `spawn code-reviewer`.
+run_one "codereview-positive"   "codereview-positive"   "claude" "must-contain" "spawn code-reviewer"
+run_one "codereview-positive"   "codereview-positive"   "codex"  "must-contain" "spawn code-reviewer"
+
+# C2: codereview-toggle-off — same data as positive but
+# CLAUDE_PLUGIN_OPTION_ENABLECODEREVIEWER=false -> Branch C MUST be silent.
+run_one "codereview-toggle-off" "codereview-toggle-off" "claude" "must-not-contain" "" "spawn code-reviewer"
+run_one "codereview-toggle-off" "codereview-toggle-off" "codex"  "must-not-contain" "" "spawn code-reviewer"
+
+# C3: codereview-not-idea — proposal.inputType != "idea" -> Branch C
+# MUST skip at the idea-rooted gate.
+run_one "codereview-not-idea"   "codereview-not-idea"   "claude" "must-not-contain" "" "spawn code-reviewer"
+run_one "codereview-not-idea"   "codereview-not-idea"   "codex"  "must-not-contain" "" "spawn code-reviewer"
+
+# C4: codereview-not-last — a task still in_progress -> Branch C silent.
+run_one "codereview-not-last"   "codereview-not-last"   "claude" "must-not-contain" "" "spawn code-reviewer"
+run_one "codereview-not-last"   "codereview-not-last"   "codex"  "must-not-contain" "" "spawn code-reviewer"
+
+# C5: codereview-ordering — idea-rooted, all done, NO report Document, so
+# BOTH Branch C and Branch B fire. The code-review reminder MUST precede
+# the completion-report reminder in the combined output.
+run_one "codereview-ordering"   "codereview-ordering"   "claude" "must-precede" "spawn code-reviewer" "create idea-completion report"
+run_one "codereview-ordering"   "codereview-ordering"   "codex"  "must-precede" "spawn code-reviewer" "create idea-completion report"
+
 echo ""
 echo "Results: $PASS passed, $FAIL failed"
 

package/.next/standalone/public/chorus-plugin/skills/brainstorm/SKILL.md

@@ -4,7 +4,7 @@ description: Optional divergent-then-convergent dialogue for fuzzy ideas. Invoke
 license: AGPL-3.0
 metadata:
   author: chorus
-  version: "0.10.0"
+  version: "0.11.1"
   category: project-management
   mcp_server: chorus
 ---

package/.next/standalone/public/chorus-plugin/skills/chorus/SKILL.md

@@ -4,7 +4,7 @@ description: Chorus AI Agent collaboration platform — overview, common tools,
 license: AGPL-3.0
 metadata:
   author: chorus
-  version: "0.10.0"
+  version: "0.11.1"
   category: project-management
   mcp_server: chorus
 ---
@@ -308,12 +308,14 @@ The table below shows default tool availability for each preset (no custom permi
 
 ### 5. Review Agent Configuration
 
-The plugin includes two independent review agents. After proposal submission or task verification, a PostToolUse hook injects context instructing the main agent to spawn the reviewer. The main agent must spawn it manually — it is NOT auto-launched. Both are **enabled by default**.
+The plugin includes three independent review agents. After proposal submission, task verification, or the last task of an idea-rooted proposal being verified, a PostToolUse hook injects context instructing the main agent to spawn the reviewer. The main agent must spawn it manually — it is NOT auto-launched. All are **enabled by default**.
 
 | Setting | Controls | Default |
 |---------|----------|---------|
 | `enableProposalReviewer` | Spawn `chorus:proposal-reviewer` after `chorus_pm_submit_proposal` | `true` (enabled) |
 | `enableTaskReviewer` | Spawn `chorus:task-reviewer` after `chorus_submit_for_verify` | `true` (enabled) |
+| `enableCodeReviewer` | Spawn `chorus:code-reviewer` over the Idea's aggregate change after its last task is verified (final ship gateway) | `true` (enabled) |
+| `maxCodeReviewRounds` | Max code-review rounds before escalating to a human (0 = unlimited) | `3` |
 
 To disable, reconfigure the plugin via `/plugin` settings or manually edit `~/.claude/settings.json`:
 
@@ -323,14 +325,15 @@ To disable, reconfigure the plugin via `/plugin` settings or manually edit `~/.c
     "chorus@chorus-plugins": {
       "options": {
         "enableProposalReviewer": false,
-        "enableTaskReviewer": false
+        "enableTaskReviewer": false,
+        "enableCodeReviewer": false
       }
     }
   }
 }
 ```
 
-When enabled, reviewers run as read-only sub-agents and post a VERDICT comment on the proposal/task. Three possible outcomes: **PASS** (no issues), **PASS WITH NOTES** (minor non-blocking notes), or **FAIL** (BLOCKERs found). Results are advisory — they do not block approval or verification. Disabling reduces token usage but removes the independent quality gate.
+When enabled, reviewers run as read-only sub-agents and post a VERDICT comment on the proposal/task/idea. Three possible outcomes: **PASS** (no issues), **PASS WITH NOTES** (minor non-blocking notes), or **FAIL** (BLOCKERs found). Results are advisory — they do not block approval, verification, or ship; the code-review gateway in particular is behavioral (it does not change the Idea's stored status). On a code-review FAIL, fix it via the `/chorus:quick-dev` workflow: `chorus_create_tasks` with `proposalUuid` set to the current approved proposal so the fix tasks attach to it, then execute → verify and re-run the gateway. Disabling reduces token usage but removes the independent quality gate.
 
 ---
 

package/.next/standalone/public/chorus-plugin/skills/develop/SKILL.md

@@ -4,7 +4,7 @@ description: Chorus Development workflow — claim tasks, report work, manage se
 license: AGPL-3.0
 metadata:
   author: chorus
-  version: "0.10.0"
+  version: "0.11.1"
   category: project-management
   mcp_server: chorus
 ---
@@ -237,6 +237,8 @@ Find the most recent comment containing `VERDICT:` and act on it:
 
 If no new `VERDICT:` comment appears after the reviewer returns, it exhausted its `maxTurns` budget before posting. Respawn it ONCE with a concise-budget hint in the prompt: *"Stay within turn budget. Skip deep verification. Fetch task/proposal/comments, run only the core tests, and post your VERDICT comment within the first 12 turns."* If the second attempt still produces no VERDICT, review manually using the checklist and proceed.
 
+> **Final code-review gateway (after the Idea's LAST task is verified):** when the task you just verified is the **last** task of its idea-rooted proposal, the feature is about to ship — the PostToolUse hook injects a reminder to spawn `chorus:code-reviewer` (gated by `enableCodeReviewer`, default on). Spawn it yourself in **foreground**, passing the `ideaUuid` + round number; it reviews the Idea's **aggregate** code change across all its tasks (cross-task integration, architecture, security, regression, feature-level coverage) and posts one `VERDICT` comment on the **idea**. `PASS` / `PASS WITH NOTES` → ship; `FAIL` → fix via `/chorus:quick-dev` (`chorus_create_tasks` with `proposalUuid` set to the current approved proposal so the fix tasks attach to it — do NOT reopen the verified tasks), then re-run the gateway, bounded by `maxCodeReviewRounds`. Advisory/behavioral, like the other reviewers. Run it **before** any idea-completion report.
+
 ### Step 9: Handle Review Feedback
 
 If the reviewer returns **FAIL**, or the task is reopened after verification: