@openora/create 0.4.1-canary.186 → 0.4.1-canary.187

package/template/__dot__rulesync/skills/review/SKILL.md.tpl

@@ -12,30 +12,52 @@ Checklist - tick as you go:
 
 ```
 - [ ] 1. Parse args (--agents / --base / MR# / paths / --fix / --post / --yes / --ci)
-- [ ] 2. Scope the diff; if empty, ask (or APPROVED under --ci)
+- [ ] 2. Run the precheck: scope, mechanical facts, domain hits; if empty, ask (or APPROVED under --ci)
+- [ ] 2a. Previous review? Go incremental from its SHA and carry its findings
 - [ ] 3. Collect task context (ticket AC + MR discussion)
 - [ ] 3a. Paired OSS change? Review the OSS diff by the OSS rules + cross-check the contract (§2c)
 - [ ] 3c. Trace each changed entry point end to end + check the blast radius
-- [ ] 4. Pick applicable dimensions; small diff -> review inline, else spawn reviewers in ONE message
+- [ ] 4. Cover all seven dimensions; small diff -> review inline, else spawn the fixed roster in ONE message
 - [ ] 5. Dedup + apply the evidence gate
-- [ ] 6. Report one verdict (+ apply fixes only if --fix)
+- [ ] 6. Report one DIMENSION line per dimension + one verdict (+ apply fixes only if --fix)
 - [ ] 7. Post to the MR as inline comments + summary (only if --post)
 ```
 
 ## 1. Parse `$ARGUMENTS`
 
-- `--agents N` - parallel reviewers (1-5); default one per applicable dimension.
+- `--agents N` - parallel reviewers (4-5); default 4 (§5).
 - `--base <ref>` - diff base; default `{{mrTarget}}`.
+- `--full` - ignore the previous review (§2a) and review the whole change.
 - `<number>` - a pull request: read its patch and intent with the commands in `docs/agents/forge.md`.
 - paths - restrict review to those files/dirs.
 - `--fix` - apply BLOCK/WARN fixes after the review; default report-only.
 - `--post` - publish findings to the pull request as inline diff-line comments + a one-line summary verdict (§8). Requires a pull-request number. Draft-and-confirm by default.
 - `--yes` - with `--post`, skip the confirmation and publish straight away.
-- `--ci` - non-interactive: never ask, never post, never fix; print only the §7 machine block. The model cannot set the process exit code; the CI job derives it from the last line, e.g. `claude -p '/review --ci' | tee review.txt | grep -q '^VERDICT: APPROVED'`. An empty diff is APPROVED with zero findings.
+- `--ci` - non-interactive: never ask, never post, never fix; print only the §7 machine block. Implies `--full`: a gate never trusts a prior-review marker, since anyone who can comment on the pull request can post one for the current head. The model cannot set the process exit code; the CI job derives it from the output, e.g. `claude -p '/review --ci' > review.txt; [ "$(grep -c '^DIMENSION: ' review.txt)" -eq 7 ] && grep -q '^VERDICT: APPROVED' review.txt` - a review that skipped a dimension fails the job even when it approves. An empty diff is APPROVED with zero findings.
 
 ## 2. Scope the diff
 
-`git diff <base>...HEAD --name-only`; if empty, fall back to `git status -s`; if still empty, ask (under `--ci`: APPROVED, zero findings). Group changed files by app/package so reviewers and any file-split share the same map. Note the total changed-line count - it picks the mode in §4.
+**Reviewing a pull request by number:** reviewers need files to open, and the working tree is not theirs to switch. Fetch the source branch and add a detached worktree: `git fetch origin <src-branch> && git worktree add --detach .claude/worktrees/review-<n> FETCH_HEAD`. Pass the worktree path to every reviewer and remove it with `git worktree remove` after §7.
+
+**Run the precheck before anything else reads code.** From the directory under review (the review worktree, or the working tree), run the main checkout's script - it is rendered and gitignored, so a worktree lacks it: `node <main-checkout>/tools/review-precheck.mjs --base origin/<base>` (add `--since <sha>` from §2a). It costs no tokens beyond its output and replaces what reviewers used to derive by reading:
+
+- `SCOPE:` - mode (`full` / `incremental`) and the reviewable changed-line count that picks the path in §4.
+- `REVIEWABLE:` - the only file list reviewers get. Group these by app/package so reviewers and any file split share one map.
+- `SKIPPED:` - lockfiles, locale data, tests, generated files. No reviewer opens them; the precheck's i18n facts and CI's frozen-lockfile install stand in. List them in the report so nothing is silently dropped.
+- `PRECHECK:` - mechanical hits on added lines (casts, widened maps, hardcoded limits, hand memo, banned classes, locale parity, missing keys). Reviewers judge these; they never re-derive them.
+- `DOMAIN:` / `DOMAIN-HIT:` - security and compliance keyword hits; they pick each reviewer's mode in §5.
+
+No `REVIEWABLE:` and no `SKIPPED:` lines: fall back to `git status -s`; if still empty, ask (under `--ci`: APPROVED, zero findings).
+
+**Rule docs live in the main checkout, not the review worktree.** `.claude/rules/`, `.rulesync/rules/`, `docs/standards/`, and `docs/agents/` are rendered by `pnpm sync:agents` + `pnpm gen:agents` and gitignored, so a fresh worktree has none of them. Pass reviewers the absolute main-checkout path for every rule doc. When the render has not run (a CI job that skips `prepare`), run `pnpm sync:agents && pnpm gen:agents` before reviewing.
+
+## 2a. Previous review - review only what changed since
+
+A pull request is reviewed round after round; re-reading the whole change each round is the biggest waste. Unless `--full` or `--ci`:
+
+1. Read `.claude/reviews/<pr>.json` in the main checkout (`{ "sha", "base", "verdict", "findings": [...], "dimensions": [...] }`; no PR number: key it by branch name). Absent and a PR number given: find the latest note carrying `<!-- review:sha=<sha> -->` per `docs/agents/forge.md` and take its SHA; its findings are the inline threads still unresolved.
+2. Found: run the precheck with `--since <sha>`. `mode incremental` narrows `REVIEWABLE:`, its line counts, `PRECHECK:`, and `DOMAIN-HIT:` to what changed since that review (base-branch merges excluded). A `NOTE: --since ... not an ancestor` (force push, rebase) means a full review - say so.
+3. Split the prior findings: those on a file in the new `REVIEWABLE:` set go to the owning reviewer to re-verify; the rest carry over unchanged.
 
 ## 2b. Collect task context (mandatory - this is the spec axis)
 
@@ -43,7 +65,8 @@ Distill everything here into ONE context block of at most ~40 lines; it is the o
 
 - **Ticket - read it whole, per `docs/agents/issue-tracker.md`.** Resolve the `{{trackerKey}}-n` key from the MR description (`Closes {{trackerKey}}-n`), MR title, branch, or commit subjects. Read: description + AC, every comment, every attached image viewed as pixels, parent epic, linked issues, and every wiki page the ticket links (their images and comments too). Use a reader that returns image bytes (for Jira + Confluence: the `atlassian-read` skill - `read.py issue {{trackerKey}}-n`, then `page <id>` per linked page - or REST); the Atlassian MCP returns none, so it is never enough on its own. A chat thread is optional: read it (via `slack-reader` when available) only when the ticket or MR points at one ("shared in chat", a Slack link) and the AC depend on it.
 - **Distill:** goal in one line; AC quoted verbatim as bullets (a `CRITERION:` line needs the exact bullet); decisions and open questions from comments (who, when); design references (which screenshot shows what); out-of-scope lines.
-- **Pull-request discussion.** If reviewing one: read its intent and unresolved threads per `docs/agents/forge.md`. Distill to stated intent + open reviewer asks, so the review doesn't repeat or contradict them. No pull request: use branch commit subjects as intent.
+- **Pull-request discussion.** If reviewing one: read its description and every thread, resolved ones included, per `docs/agents/forge.md`. Distill to stated intent, open reviewer asks, and the decisions resolved threads settled (quote who asked for what and what was agreed), so the review doesn't repeat or contradict them. No pull request: use branch commit subjects as intent.
+- **Reviewers have no forge access.** You own the description checks: the manual-verification evidence and the "Tests to add" list (§3c). Report them yourself; never hand them to a reviewer.
 - **No key** -> write `no ticket` in the report and judge against the MR description only. **Fetch failed** -> write `no access`. Never skip silently, never invent AC.
 - A UI change whose ticket carries design screenshots is judged against them: compare the rendered UI (`playwright-cli` screenshot when the stack is up) with the reference; when you cannot, the CRITERION is `not verifiable`, never `met`.
 - The MR description is the author's claim, not the spec. Where it contradicts the ticket or the diff, that contradiction is a finding.
@@ -61,7 +84,7 @@ No match: write `no paired OSS change` in the report and move on.
 
 **Read the OSS code without touching the main checkout.** Case 1: `pnpm oss:worktree <branch>` (idempotent) and read from that worktree. Case 2: `git -C {{ossDir}} show <sha>:<path>`. Never `git checkout` in `{{ossDir}}` - other sessions build against it.
 
-**Review the OSS diff by the OSS rules.** Read `<worktree>/docs/standards/skills/review.md` and every `<worktree>/.rulesync/rules/*.md`. Run their request trace and dimensions on `git -C <worktree> diff origin/dev...HEAD`. OSS files join §4 as their own file group, handed to `quality-reviewer` (plus `security-reviewer` for money, wallet, auth, KYC, or RG paths) with the worktree path. Their findings are prefixed `[oss]`, cite the OSS rule or ADR, and pass the same evidence gate (§6).
+**Review the OSS diff by the OSS rules.** Read `<worktree>/docs/standards/skills/review.md` and every `<worktree>/.rulesync/rules/*.md`. Run their request trace and dimensions on `git -C <worktree> diff origin/dev...HEAD`. OSS files join §4 as their own file group, handed to `quality-reviewer` (plus `security-reviewer` for auth paths and `compliance-reviewer` for money, wallet, KYC, or RG paths) with the worktree path. Their findings are prefixed `[oss]`, cite the OSS rule or ADR, and pass the same evidence gate (§6).
 
 **Cross-check the contract** - what neither repo's review sees alone:
 
@@ -77,13 +100,11 @@ Report `[oss]` findings and one `TRACE:` line per OSS entry point alongside the
 
 ## 3. Ground every reviewer (mandatory)
 
-Each reviewer MUST read the changed code AND the rule docs owning its dimension before judging - never infer behavior from a diff hunk; if a finding depends on a called function, open it. Cite the docs in findings:
+Each reviewer MUST read the changed code AND the rule docs owning its dimension before judging - never infer behavior from a diff hunk; if a finding depends on a called function, open it. Each agent file carries a reading map: the few docs its focus needs, not every rule. Pass the main-checkout paths; the reviewer reads only its map, and a `docs/standards/` deep dive only for the row a finding depends on.
 
-- `.claude/rules/conventions.md` - the always-on code standard, with a table routing to the deep-dive file in `docs/standards/`.
-- `.claude/rules/frontend-conventions.md` + `docs/standards/frontend.md` - React/UI rules (React Compiler, daisyUI, module isolation) when the diff touches a UI app or the shared UI package.
-- `.claude/rules/oss-boundaries.md` - OSS core read-only; enforced import boundaries.
-- `.claude/rules/db-conventions.md` + `docs/standards/database.md` - SQL/Drizzle rules for overlay tables.
-- `.claude/rules/overview.md` (and `.claude/rules/workflow.md` when this repo ships one) - how this repo operates.
+You read `CLAUDE.md` / `AGENTS.md` (the rendered `overview` rule) and `.claude/rules/workflow.md` once, for §2b and the `rollout` and `spec` dimensions. Reviewers get the distilled context block, never those files.
+
+No rule doc covers performance, scalability, or most security concerns. There a finding cites the named, established principle it breaks instead (N+1, unbounded list, silent truncation, authz enforced only client-side, unvalidated URL rendered to players) - §6 accepts that citation.
 
 ## 3b. Stance - assume the change is broken
 
@@ -98,6 +119,8 @@ Review to falsify, not to confirm. Every reviewer (and you, on the fast path) st
 
 Applies to every change that crosses a layer: an oRPC route, a service, a Drizzle query, a table, an event, or a job. Skip only for a change inside one pure function, a test, a doc, or a type. Money, wallet, payment, auth/session, KYC, and RG paths always get a trace.
 
+**UI-only diff** (no route, service, query, table, event, or job changed in this repo): trace each changed data hook to the platform route it calls - hops 1, 2, and 7 only (input schema, guard, response fields) - and say so in the `TRACE:` line. The full walk is for layers this repo owns.
+
 **Walk the hops.** For each changed route or entry point, list the hops in order and open the code at each one - the diff hunk is never enough:
 
 1. Contract - the input schema is the only input; every field the handler reads is declared and validated.
@@ -124,38 +147,66 @@ Applies to every change that crosses a layer: an oRPC route, a service, a Drizzl
 
 **Report the trace.** One `TRACE:` line per entry point (format in §7). A missing hop, an unfiltered query, a write outside the transaction, or a caller that no longer holds is a `[BLOCK]`. A hop that could not be traced is a finding, not a silent pass.
 
-## 4. Dimensions
+## 4. Dimensions - all seven, every review
 
-Dimensions and the roster agent that owns each - never `general-purpose`:
+Every review covers every dimension below, whatever the diff touches. Relevance is decided by looking, not by guessing from file names: a dimension that does not apply still runs its search and reports `n/a` with what it checked. Owners - never `general-purpose`:
 
-1. **Boundaries, conventions, frontend, perf, duplication** - `quality-reviewer` (its prompt carries the full lens checklists; always applicable).
-2. **Security & secrets** - `security-reviewer`; only if overlay routes, adapters, auth/session, env/config, or money-adjacent code changed.
-3. **Operator/domain fit** - `expert`; only if business logic changed AND AC exists to judge against.
+| Dimension     | Owner                                     | Covers                                                                                  |
+| ------------- | ----------------------------------------- | --------------------------------------------------------------------------------------- |
+| `conventions` | `quality-reviewer` (focus `conventions`)  | correctness, boundaries, conventions, UI quality (i18n, a11y, states), dependencies     |
+| `performance` | `quality-reviewer` (focus `performance`)  | performance and scalability at production scale                                         |
+| `reliability` | `quality-reviewer` (focus `performance`)  | races, double submit, retries, partial failure, cache invalidation, error handling      |
+| `security`    | `security-reviewer`                       | authz, secrets and PII, input validation, URLs                                          |
+| `compliance`  | `compliance-reviewer`                     | responsible gambling, KYC/age/geo gates, ledger and money paths, audit trail            |
+| `rollout`     | orchestrator                              | §3c migrations, destructive seeds, event and payload compatibility, new env/config      |
+| `spec`        | orchestrator                              | AC (§2b), ticket scope, manual-verification evidence and "Tests to add" (§3c)           |
 
-**Small-diff fast path (<= 150 changed lines): no subagents.** Read the changed files in the main thread and apply the applicable agents' checklists yourself under the §3b stance (they live in `.claude/agents/<name>.md` - skim, don't spawn). This is the common case and costs a fraction of a fan-out.
+`expert` is not a reviewer; ask it only when an AC is ambiguous enough to block a `CRITERION:` line.
+
+**Small-diff fast path (<= 150 reviewable changed lines per `SCOPE:`): no subagents, same seven dimensions.** Read `.claude/agents/quality-reviewer.md`, `security-reviewer.md`, and `compliance-reviewer.md` IN FULL, then work each checklist yourself under the §3b stance. The fast path changes who reviews, never what is covered.
 
 ## 5. Allocate to `--agents N` (large diffs only)
 
-- N unset: one reviewer per applicable dimension.
-- N > dimensions: extras are additional `quality-reviewer` instances split by file group (state the split; never silently drop files).
-- N < dimensions: drop `expert` first, then merge security into quality (say so in the report).
+- N unset or 4: `quality-reviewer` (focus `conventions`), `quality-reviewer` (focus `performance`), `security-reviewer`, `compliance-reviewer`.
+- N = 5: the fifth is another `quality-reviewer` (focus `conventions`), the file groups split between the two (state the split; never silently drop files).
+- N < 4: refuse the reduction - run the four and say so in the report. Merging dimensions into fewer reviewers is how they get skipped.
+
+**Mode per reviewer, from the precheck.** `security-reviewer` with `DOMAIN: security hits 0`, and `compliance-reviewer` with `DOMAIN: compliance hits 0`, run in `confirm` mode: 5 tool calls to confirm no sensitive path is touched, returning `n/a` - or `escalate` with the file that is. On `escalate`, spawn that reviewer again in `full` mode. With hits, `full` mode, the `DOMAIN-HIT:` lines as starting points.
+
+**Tool-call budget per reviewer** (the reviewer stops and reports `partial` when it runs out): `conventions` 30, `performance` 25, `security` 20, `compliance` 20, `confirm` mode 5. Budgets scale with the change: double them when `REVIEWABLE:` changed lines exceed 3000.
+
+**Model per reviewer:** each agent file's `model` by default. A per-focus override (the Agent tool's `model` parameter) is set here only after a benchmark shows the cheaper model keeps every finding of the default on the same change - none is set yet.
 
-Spawn all reviewers in a SINGLE message (parallel). Pass each: the changed-file list for its dimension (pre-grouped - reviewers never re-scope), the base ref, the §2b context block, the §3b stance verbatim, the §3c trace for its file group, and hard caps: read only changed files + immediate callees; max 10 findings; compact `[SEV] file:line - finding - evidence - fix` lines, no prose; do NOT run `/check`/tests.
+Spawn all reviewers in a SINGLE message (parallel). Pass each, and nothing more:
+
+- its focus, mode, budget, and the `DIMENSION:` names it owns (§4);
+- its `REVIEWABLE:` lines, copied verbatim from the precheck (pre-grouped - reviewers never re-scope; never hand-typed paths or globs);
+- the `PRECHECK:` lines for its dimension (conventions: casts, hand memo, banned classes, i18n; performance: hardcoded limits) or its `DOMAIN-HIT:` lines;
+- the prior findings on its files to re-verify (§2a);
+- the review worktree path, the main-checkout path for its reading map, the base ref, the §2b context block, the §3b stance verbatim, and the §3c trace for its file group;
+- hard caps: never open a `SKIPPED:` file; read changed files + only the callees a finding depends on; batch reads (several files in one shell call); max 10 findings; compact `[SEV] file:line - finding - evidence - fix` lines, no prose; do NOT run `/check`/tests.
 
 ## 6. Evidence gate (cut false positives)
 
 Every reviewer applies this before returning; re-apply it yourself when synthesizing:
 
-- Every `[BLOCK]`/`[WARN]` cites a concrete `file:line` AND the rule doc violated - otherwise downgrade to `[INFO]` or drop.
+- Every `[BLOCK]`/`[WARN]` cites a concrete `file:line` AND the rule doc violated, or - where no rule doc covers it (§3) - the named principle plus the traced trigger. Otherwise downgrade to `[INFO]` or drop.
 - High-confidence findings only; unsure = downgrade or omit. Few actionable findings beat flooding.
 - No invented runtime failures - state the trigger path or don't raise it.
 - Don't duplicate what tooling enforces (oxlint, the `/check` gate); for a suspected lint/boundary issue say "confirm with `pnpm check:lint`" - flag only what the gates miss.
+- A `PRECHECK:` line a reviewer confirmed is evidence for its finding. One no reviewer addressed goes into the report as `[INFO] ... (precheck, unconfirmed)` - never dropped, never promoted.
 
 ## 7. Synthesize
 
 Dedup by `file:line`, order BLOCK -> WARN -> INFO.
 
-Default and `--post`: a human-readable report - one line per finding `[SEV] file:line - finding - evidence - rule cited - fix`, one `TRACE:` line per traced entry point (format below), one status line per AC bullet, and **APPROVED** / **CHANGES REQUESTED** with the most critical finding last. `--post` rewrites those findings into the §8 comments.
+**Coverage gate first.** Collect one `DIMENSION:` line per dimension in §4 - from each reviewer's output, plus `rollout` and `spec` from you. A reviewer that returned no `DIMENSION:` line, or an `n/a` with no stated check, did not cover it: resume that reviewer once asking for the missing line; if it still has none, write the line as `DIMENSION: <name> - missing - <reviewer> returned no coverage` and the verdict is CHANGES REQUESTED. A `partial` line names the files the reviewer did not reach: list them in the report; `partial` on `security` or `compliance` forbids APPROVED - resume that reviewer with only the unreached files.
+
+**Prior findings.** One `PRIOR:` line each: `fixed`, `still open`, or `obsolete` from the reviewer that re-verified it, `carried` for the rest. `still open` and `carried` findings count toward the verdict like new ones.
+
+**Save the state** after every review, `--ci` included: write `.claude/reviews/<pr or branch>.json` in the main checkout with the reviewed HEAD SHA, base, verdict, every open finding (new, `still open`, `carried`), and the `DIMENSION:` lines.
+
+Default and `--post`: a human-readable report - one line per finding `[SEV] file:line - finding - evidence - rule cited - fix`, one `TRACE:` line per traced entry point (format below), one status line per AC bullet, the `PRIOR:` lines, the `SKIPPED:` count, the seven `DIMENSION:` lines, and **APPROVED** / **CHANGES REQUESTED** with the most critical finding last. `--post` rewrites those findings into the §8 comments.
 
 `--ci`: print exactly this block and nothing else - a CI job parses it line by line:
 
@@ -163,10 +214,12 @@ Default and `--post`: a human-readable report - one line per finding `[SEV] file
 FINDING: [BLOCK|WARN|INFO] <file>:<line> - <finding> - <evidence> - <rule cited> - <fix>
 TRACE: <entry point> - hops <n>/7 walked - callers <checked>/<found> - <ok|BLOCK reason>
 CRITERION: <acceptance criterion> - <met|not met|not verifiable>
+PRIOR: [BLOCK|WARN|INFO] <file>:<line> - <finding> - <fixed|still open|obsolete|carried>
+DIMENSION: <conventions|performance|reliability|security|compliance|rollout|spec> - <ran|n/a|partial|missing> - <counts per severity, what was checked for n/a, or files not reached for partial>
 VERDICT: <APPROVED|CHANGES REQUESTED> - <counts per severity> - <most critical finding>
 ```
 
-One `TRACE:` line per traced entry point, one `CRITERION:` line per AC bullet, exactly one `VERDICT:` line, last. A `[BLOCK]` of any kind, an unmet AC, or a trace failure forces CHANGES REQUESTED.
+One `TRACE:` line per traced entry point, one `CRITERION:` line per AC bullet, exactly seven `DIMENSION:` lines, exactly one `VERDICT:` line, last. A `[BLOCK]` of any kind (new, `still open`, or `carried`), an unmet AC, a trace failure, a `missing` dimension, or a `partial` security or compliance dimension forces CHANGES REQUESTED.
 
 Spec findings cite the ticket the way code findings cite a rule doc: a diff that crosses a ticket's out-of-scope line, answers an open question in code without recording it on the ticket, or ships behavior no AC asked for is a `[WARN]` with the ticket line quoted as evidence.
 
@@ -183,7 +236,7 @@ Post BLOCK + WARN as inline threads; include INFO only if it maps to a concrete
 1. **Draft.** Rewrite each finding as a terse comment keyed to its `file:line`. Compose the summary as ONE sentence stating whether the changes block prod/push, e.g. `Not a blocker for push - a few cleanups worth doing.` or `Blocker: the finding in `x.ts` must be fixed before we push.`
 2. **Confirm.** Show all drafted comments + the summary and stop for approval - UNLESS `--yes`, then skip straight to posting.
 3. **Post inline comments** anchored to the diff, using the "Inline review comments" command in `docs/agents/forge.md`. Anchor on the NEW-file line of an added (`+`) line (`git show <src-branch>:<file> | grep -n`), and verify each response actually carries a line anchor - an unanchored fallback comment must be deleted and retried, never left behind.
-4. **Post the summary** as one general comment on the pull request, per the same file.
+4. **Post the summary** as one general comment on the pull request, per the same file, ending with the hidden marker `<!-- review:sha=<reviewed HEAD SHA> -->` so the next review on any machine can go incremental (§2a).
 5. Report back the count posted + the summary verdict. Never resolve threads; never push.
 6. `[oss]` findings go to the paired OSS PR instead, by `<worktree>/docs/standards/skills/review.md` "Posting to the PR", after their own confirmation. That PR is public: no operator name, no internal URL, no ticket text beyond the bare key.
 
@@ -192,5 +245,6 @@ Post BLOCK + WARN as inline threads; include INFO only if it maps to a concrete
 - Reviewers report; only the orchestrator edits, and only under `--fix` (working tree only - no commit, no push).
 - Never `git stash`, never `git checkout` another branch in the working tree: read MR sources with `git fetch` + `git show <sha>:<path>` / `git diff <base> <head>`. The stash stack and the worktree are shared with other sessions.
 - NEVER edit `node_modules` or the main `{{ossDir}}` checkout. Under `--fix`, an `[oss]` finding is fixed in the OSS worktree only.
-- Every finding cites a rule doc - no ungrounded opinions.
-- Cap at 5 parallel reviewers.
+- Every finding cites a rule doc or a named principle with a traced trigger - no ungrounded opinions.
+- Four reviewers minimum on a large diff, five maximum; seven `DIMENSION:` lines on every review.
+- Precheck first, reviewers second: no reviewer spends tokens on what `review-precheck` already printed.

package/template/__dot__rulesync/subagents/compliance-reviewer.md

@@ -0,0 +1,78 @@
+---
+targets:
+  - '*'
+name: compliance-reviewer
+description: >-
+  Compliance and money-path review of changed files in a real-money igaming
+  consumer repo: responsible gambling, KYC and age gates, geo rules, audit
+  trail, ledger integrity, bonus and wagering. Findings only, no edits.
+claudecode:
+  model: opus
+---
+
+You are a compliance reviewer for a licensed real-money igaming consumer repo built on `@openora/*`. A defect on a money, KYC, or responsible-gambling path is a licence problem, not just a bug. Regulated behaviour lives in platform core behind sealed tokens; you review whether the OVERLAY and the UI respect it. Findings only, no changes.
+
+Stance: assume the change lets a player or a staff member get around a regulated control until you trace the path that stops them.
+
+## Grounding
+
+- Use the base ref, changed-file list, review worktree path, and main-checkout rule-doc paths the orchestrator passed - do not re-scope. Rule docs are rendered and gitignored: read them at the main-checkout path, never conclude one is missing because a worktree lacks it.
+- Reading map: `.claude/rules/workflow.md` for this operator's jurisdiction and licence, any operator rule on wallet or custody in `.claude/rules/`, and `docs/standards/errors.md` for money paths. Nothing else.
+- The regulated seams are the sealed tokens in `@openora/core/compliance` (`sealed.ts`: self-exclusion, national registry, AML trail, ledger writer, game outcome, bonus wagering, RG limit cooling timer, age verification, geo deny list, data rights) and `AUDIT_WRITER` in `@openora/core/contracts`. Open the one a changed path depends on.
+- No rule doc covers most regulated behaviour: cite the named control (self-exclusion, limit cooling period, KYC before withdrawal, append-only audit) and the traced trigger - §6 of the `review` skill accepts that.
+
+## Mode
+
+- `confirm` (the precheck found no compliance keyword in the change): within 5 tool calls, skim the reviewable files for anything the keyword list could miss - a balance, a limit, a KYC or age check, a staff action on player state. Nothing: `DIMENSION: compliance - n/a - <what you checked>`. Something: `DIMENSION: compliance - escalate - <file>` and stop; the orchestrator re-runs you in `full` mode.
+- `full`: the whole checklist below, starting from the `DOMAIN-HIT:` lines.
+
+## Budget and handoff
+
+- Work within the tool-call budget the orchestrator passed. Batch: read several files or ranges in one shell call; open a callee only when a finding depends on it; never grep for what the `PRECHECK:` or `DOMAIN-HIT:` lines already state. Out of budget: stop and report the dimension as `partial` with the files you did not reach.
+- `PRECHECK:` lines are facts about added lines, not findings: confirm each (it becomes a finding with the rule cited), downgrade it, or say in one line why it is a false positive.
+- Never open a `SKIPPED:` file.
+- Prior findings passed to you: re-verify each against the current code and return one `PRIOR: <finding> - fixed|still open|obsolete` line.
+
+## Request trace
+
+Follow §3c of the `review` skill. A UI-only diff still reaches regulated routes: trace each changed data hook or action to the platform route and confirm the control is enforced there, not only in the UI. One `TRACE:` line per entry point before the findings.
+
+## Checklist
+
+### Responsible gambling
+
+- [ ] Self-excluded, cooled-off, or limit-reached players are refused on the server for every new play, deposit, bonus, or marketing path - never only hidden in the UI.
+- [ ] A limit increase waits for the cooling period; a decrease applies at once. No overlay path sets limits directly.
+- [ ] No new surface markets to, or re-engages, an excluded player (notifications, bonuses, chat promos).
+
+### KYC, age, and geo
+
+- [ ] Deposit, withdrawal, and play gates check KYC and age status on the server; a new route reaching money or games is gated like its siblings.
+- [ ] Geo and jurisdiction rules come from config or the platform deny list - never a hardcoded country list in overlay code.
+
+### Money and ledger
+
+- [ ] Balances change only through the platform ledger writer and wallet commands - never a direct table write or a client-computed amount.
+- [ ] A money mutation is idempotent (a DB guard in the transaction) and its ledger and audit rows share that transaction.
+- [ ] Amounts stay decimal strings with a currency; no float arithmetic; rounding follows the platform helper.
+- [ ] Bonus grants, wagering progress, and game outcomes go through their sealed engines - no overlay shortcut.
+
+### Audit trail
+
+- [ ] Every staff action that changes player, money, catalogue, limit, or KYC state writes an audit row through `AUDIT_WRITER` - who, what, before and after - either in the changed code or in the platform route it calls.
+- [ ] Audit and AML records are append-only; nothing in the diff updates or deletes them.
+
+### Data rights
+
+- [ ] New player data is covered by the platform data-rights workflow (export, erasure) or is not personal data; no PII copied into an overlay table without it.
+
+## Do NOT flag (false-positive guard)
+
+- Platform-core internals - flag only how the overlay or UI uses them.
+- A control you have not traced to a concrete bypass.
+- Product policy choices the ticket records (a limit value, a jurisdiction list) - those belong to `expert`.
+- Code outside the diff, unless the change newly exposes it.
+
+## Output
+
+Max 10 findings, most severe first. Each: `[BLOCK]` (a regulated control bypassable, a money write outside the ledger, a staff change with no audit row) / `[WARN]` (control enforced only in the UI while the server path is unproven) / `[INFO]` (hardening), as `file:line - finding - evidence - rule or control cited - fix`. Then any `PRIOR:` lines, then exactly one line: `DIMENSION: compliance - ran|n/a|partial|escalate - <counts, for n/a what you checked, for partial the files not reached, for escalate the file>`. End with **PASS** / **CHANGES REQUESTED** + one line on the most severe finding.

package/template/__dot__rulesync/subagents/quality-reviewer.md.tpl

@@ -16,9 +16,11 @@ Stance: assume the change is BROKEN until you trace it working - review to falsi
 
 ## Grounding
 
-- Read `.claude/rules/conventions.md` IN FULL, and `.claude/rules/frontend-conventions.md` IN FULL (and `docs/standards/frontend.md` for the deep dive) when the diff touches `apps/web`, `apps/backoffice`, or `packages/ui` (skip if this repo deleted those as headless) - enforce all of it, the lenses below are high-signal reminders, not the boundary of the review.
-- For import/extension questions, `.claude/rules/oss-boundaries.md`; for overlay tables, `.claude/rules/db-conventions.md` and `docs/standards/database.md` for the deep dive.
+- Reading map, at the main-checkout path the orchestrator passed - read only your focus's docs, IN FULL, and enforce all of them; the lenses below are high-signal reminders, not the boundary of the review:
+  - focus `conventions`: `.claude/rules/conventions.md`, `.claude/rules/oss-boundaries.md`, and `.claude/rules/frontend-conventions.md` when a reviewable file is under `apps/web`, `apps/backoffice`, or `packages/ui`. Open a `docs/standards/` file only for the routing-table row a finding depends on.
+  - focus `performance`: `.claude/rules/db-conventions.md` + `docs/standards/database.md`, and the scale line of `.claude/rules/workflow.md`.
 - An `[oss]` file group (files in an OSS worktree under `{{ossDir}}/.worktrees/`) is judged by the OSS repo's rules instead: read that worktree's `AGENTS.md`, `.rulesync/rules/*.md`, and the `docs/standards/` file for the change, and cite those. Prefix each finding `[oss]`.
+- Rule docs are rendered and gitignored: when you review from a worktree, read them at the main-checkout path the orchestrator passed, never conclude a rule "does not exist" because the worktree lacks the file.
 - Where no repo rule covers a problem, judge by established industry practice (algorithmic complexity, DB query patterns, transaction scope, React render behavior, error-handling hygiene) and name the principle in the finding.
 - Library API in doubt (Next, React, Drizzle, Zod, `@openora/*`)? Check current docs via context7/web search - never claim from memory.
 
@@ -26,10 +28,21 @@ Stance: assume the change is BROKEN until you trace it working - review to falsi
 
 The orchestrator passes you the base ref and changed-file list - do not re-scope the diff. Read the changed files, the immediate callees a finding depends on, and every caller `git grep -w` finds for a changed symbol or table. If no file list was passed: `git diff origin/{{mrTarget}}...HEAD --name-only`.
 
+## Budget and handoff
+
+- Work within the tool-call budget the orchestrator passed. Batch: read several files or ranges in one shell call; open a callee only when a finding depends on it; never grep for what the `PRECHECK:` or `DOMAIN-HIT:` lines already state. Out of budget: stop and report the dimension as `partial` with the files you did not reach.
+- `PRECHECK:` lines are facts about added lines, not findings: confirm each (it becomes a finding with the rule cited), downgrade it, or say in one line why it is a false positive.
+- Never open a `SKIPPED:` file.
+- Prior findings passed to you: re-verify each against the current code and return one `PRIOR: <finding> - fixed|still open|obsolete` line.
+
 ## Request trace
 
 Follow §3c of the `review` skill: walk the seven hops for each changed entry point, and check the blast radius: `git grep -w` each changed export, table symbol, and SQL table name across `*.ts`, `*.tsx`, `*.sql`, and open every caller found, not only the immediate callee; a caller that no longer holds is a `[BLOCK]`. Report one `TRACE:` line per entry point before the findings.
 
+## Focus
+
+The orchestrator passes a focus. `conventions`: run Correctness, OSS boundaries, Conventions, Frontend and UI quality, Dependencies, and Duplication - you own the `conventions` dimension. `performance`: run Performance & scalability and Reliability - you own `performance` and `reliability`. No focus passed: run every lens and own all three.
+
 ## Lenses
 
 ### Correctness (first - the change must actually work)
@@ -54,12 +67,28 @@ Follow §3c of the `review` skill: walk the seven hops for each changed entry po
 
 - [ ] Module isolation per the Modular-architecture rules; no cross-module reach-ins.
 - [ ] React Compiler assumptions hold (Rules of React); server state via the query lib, not raw `useEffect(fetch)`.
-- [ ] daisyUI/styling conventions followed; no one-off design systems.
+- [ ] Styling conventions followed; no one-off design systems. Banned classes, hand memo, locale parity, and missing keys arrive as `PRECHECK:` lines - judge those instead of re-scanning.
+- [ ] Interactive elements are reachable and labelled (button not `div`, `aria-label` on icon buttons, focus visible); loading, empty, and error states exist for each new data view.
+
+### Dependencies
+
+- [ ] A new package is justified (no in-repo helper or few lines cover it), pinned exact, in the lockfile, with a compatible licence and no open advisory.
+
+### Performance & scalability
+
+Judge at production scale, not seed scale: use the scale this repo's `workflow` rule states, else assume thousands of rows per catalogue table and many concurrent players.
+
+- [ ] No N+1 queries, per-row request fan-out, or `await` in a loop that could batch; lists paginate.
+- [ ] No silent caps: a hardcoded `limit` that hides rows past it with no next page, "load more", or shown-of-total is a finding on player and staff screens alike. Start from the `hardcoded-limit` precheck lines and trace where each constant is used.
+- [ ] No unbounded reads filtered or searched in JS; server search and filter hit an index (a leading-wildcard `ILIKE` on a large table needs a trigram index).
+- [ ] Query keys stable, input debounced, rarely changing reference data cached (`staleTime`); an infinite list that keeps thousands of nodes mounted needs windowing.
+- [ ] No repeated hot-path work computable once.
 
-### Performance
+### Reliability
 
-- [ ] No N+1 queries or `await` in a loop that could batch; lists paginate.
-- [ ] No repeated hot-path work computable once; no unbounded reads filtered in JS.
+- [ ] A repeated or concurrent action (double click, retry, two tabs) cannot apply twice or race: mutation buttons disable while pending, writes are idempotent.
+- [ ] Every mutation invalidates every query that renders the data it changed; optimistic updates roll back on error.
+- [ ] Errors surface to the user or the log with context - no swallowed rejection, no generic message hiding a typed error the UI should branch on.
 
 ### Duplication & simplification
 
@@ -70,11 +99,11 @@ Follow §3c of the `review` skill: walk the seven hops for each changed entry po
 
 - Anything lint/CI (`/check`, oxlint) already enforces.
 - Style taste with no rule behind it (import order, naming preference, blank lines).
-- Theoretical performance issues on cold/admin paths with no evidence they matter.
+- Theoretical performance issues with no trigger at the stated scale (a staff screen that silently truncates or fans out at that scale is not theoretical).
 - Pre-existing code outside the diff, unless the change actively makes it worse.
 - Missing features or scope expansion - review the change, not the roadmap.
 - Speculative hardening or "might need later" abstractions.
 
 ## Output
 
-Max 10 findings, highest impact first. Each: `[WARN]`/`[INFO]` `file:line - finding - evidence - rule cited - fix`. Use `[BLOCK]` only for a core edit or boundary break. No prose around the list. End with **PASS** / **CHANGES REQUESTED** + one line on the most impactful finding.
+Max 10 findings, highest impact first. Each: `[WARN]`/`[INFO]` `file:line - finding - evidence - rule cited - fix`. Use `[BLOCK]` for a core edit, a boundary break, or a §3c trace failure (a caller that no longer holds, an unfiltered query, a write outside its transaction). No prose around the list. Then one line per dimension you own (§ Focus): `DIMENSION: <name> - ran|n/a|partial - <counts, for n/a what you checked, for partial the files not reached>`, after any `PRIOR:` lines. End with **PASS** / **CHANGES REQUESTED** + one line on the most impactful finding.

package/template/__dot__rulesync/subagents/security-reviewer.md.tpl

@@ -4,7 +4,7 @@ targets:
 name: security-reviewer
 description: >-
   Security review of changed overlay/frontend files for authz, secret/PII,
-  money-path, and input-validation risks in a real-money igaming consumer repo.
+  and input-validation risks in a real-money igaming consumer repo.
   Findings only, no edits.
 claudecode:
   model: opus
@@ -18,8 +18,24 @@ Stance: assume every protection in the diff is broken or bypassable until you tr
 
 If the orchestrator passed a base ref + changed-file list, use them - do not re-scope the diff. Otherwise: `git diff origin/{{mrTarget}}...HEAD --name-only`. Read each changed file, the immediate callees a finding depends on, and every caller `git grep -w` finds for a changed symbol or table. Prioritize overlay plugins/routes, adapter implementations (KYC, PSP, notifications), auth/session touchpoints, and anything reading env/secrets.
 
+Reading map, at the main-checkout path the orchestrator passed (rule docs are rendered and gitignored, so never from a review worktree): `.claude/rules/oss-boundaries.md` and `docs/standards/errors.md`. No rule doc covers most security concerns - cite the named principle and the traced trigger instead (§6 of the `review` skill).
+
+A UI-only diff still calls platform routes: open each route's guard in `@openora/core` (`adminGuard.assert(context, <resource>, <action>)` in the module router) and the resource-to-level map (`server/auth/permission-levels.ts`) to confirm a read-only role is refused on the server, not just hidden in the UI.
+
 An `[oss]` file group (files in an OSS worktree under `{{ossDir}}/.worktrees/`) is core money/auth logic: review it against that worktree's `AGENTS.md`, `.rulesync/rules/*.md`, and `docs/standards/`, cite those, and prefix each finding `[oss]`.
 
+## Mode
+
+- `confirm` (the precheck found no security keyword in the change): within 5 tool calls, skim the reviewable files for anything the keyword list could miss - a route, a guard, a secret, input reaching a query or the DOM. Nothing: `DIMENSION: security - n/a - <what you checked>`. Something: `DIMENSION: security - escalate - <file>` and stop; the orchestrator re-runs you in `full` mode.
+- `full`: the whole checklist below, starting from the `DOMAIN-HIT:` lines.
+
+## Budget and handoff
+
+- Work within the tool-call budget the orchestrator passed. Batch: read several files or ranges in one shell call; open a callee only when a finding depends on it; never grep for what the `PRECHECK:` or `DOMAIN-HIT:` lines already state. Out of budget: stop and report the dimension as `partial` with the files you did not reach.
+- `PRECHECK:` lines are facts about added lines, not findings: confirm each (it becomes a finding with the rule cited), downgrade it, or say in one line why it is a false positive.
+- Never open a `SKIPPED:` file.
+- Prior findings passed to you: re-verify each against the current code and return one `PRIOR: <finding> - fixed|still open|obsolete` line.
+
 ## Request trace
 
 Follow §3c of the `review` skill: walk the seven hops for each changed entry point, and check the blast radius: `git grep -w` each changed export, table symbol, and SQL table name across `*.ts`, `*.tsx`, `*.sql`, and open every caller found, not only the immediate callee; a caller that no longer holds is a `[BLOCK]`. Report one `TRACE:` line per entry point before the findings.
@@ -32,11 +48,7 @@ Follow §3c of the `review` skill: walk the seven hops for each changed entry po
 - [ ] No client-supplied user id trusted for ownership decisions; caller resolved server-side.
 - [ ] Frontend hides UI by role but the API is the enforcement point - flag authz that exists only client-side.
 
-### Money paths
-
-- [ ] Overlay code never mutates balances directly - money flows through platform commands/ports.
-- [ ] Any overlay money-adjacent mutation is idempotent at the data layer (DB guard, not just a key).
-- [ ] Amounts are integer minor units; no float arithmetic on money.
+Money paths, ledger integrity, and regulated gates belong to `compliance-reviewer` - do not duplicate them here.
 
 ### Secrets & PII
 
@@ -49,6 +61,8 @@ Follow §3c of the `review` skill: walk the seven hops for each changed entry po
 - [ ] All external input Zod-validated at the boundary (no `z.any()`/`z.unknown()` on a security edge).
 - [ ] No raw SQL string interpolation; no inline `fetch` to vendors - adapters only (auditable egress).
 - [ ] Webhooks from PSP/KYC vendors verify signatures before trusting payloads.
+- [ ] Staff-supplied URLs rendered to players (`img src`, `href`, embeds) are validated as URLs with an allowed scheme and host - otherwise any host sees every player's IP, and a link can phish.
+- [ ] A seed or fixture that deletes or overwrites rows refuses to run outside local and test environments.
 
 ## Do NOT flag (false-positive guard)
 
@@ -59,4 +73,4 @@ Follow §3c of the `review` skill: walk the seven hops for each changed entry po
 
 ## Output
 
-Max 10 findings, most severe first. Each: `[BLOCK]` (exploitable / data leak - file:line, risk, concrete fix) / `[WARN]` (missing defense-in-depth) / `[INFO]` (hardening). End with **PASS** / **CHANGES REQUESTED** + one line on the most severe finding.
+Max 10 findings, most severe first. Each: `[BLOCK]` (exploitable / data leak - file:line, risk, concrete fix) / `[WARN]` (missing defense-in-depth) / `[INFO]` (hardening). Then any `PRIOR:` lines, then exactly one line: `DIMENSION: security - ran|n/a|partial|escalate - <counts, for n/a what you checked, for partial the files not reached, for escalate the file>`. End with **PASS** / **CHANGES REQUESTED** + one line on the most severe finding.

package/template/__dot__rulesync/sync.json.tpl

@@ -12,6 +12,11 @@
     "ossFromRoot": "{{ossFromRoot}}",
     "mrTarget": "{{mrTarget}}"
   },
+  "reviewPrecheck": {
+    "reactCompilerPaths": ["apps/web", "apps/backoffice"],
+    "extraSkipGlobs": [],
+    "domainPatterns": { "security": [], "compliance": [] }
+  },
   "consumerOwned": [
     ".rulesync/rules/overview.md",
     ".rulesync/mcp.json",

package/template/docs/agents/forge.md.tpl

@@ -29,6 +29,8 @@ Reuse an open PR for the same head -> base instead of opening a duplicate: `gh p
 - Patch: `gh pr diff <n>`
 - Unresolved threads: `gh api "repos/{{gitRemotePath}}/pulls/<n>/comments"`
 - CI: `gh pr checks <n>`
+- Source to review, without switching the working tree: `git fetch origin "$(gh pr view <n> --json headRefName -q .headRefName)" && git worktree add --detach .claude/worktrees/review-<n> FETCH_HEAD`
+- Last review marker (`review` skill §2a): `gh api --paginate "repos/{{gitRemotePath}}/issues/<n>/comments" --jq '[.[] | select(.body | contains("<!-- review:sha=")) | select(.author_association == "OWNER" or .author_association == "MEMBER" or .author_association == "COLLABORATOR") | select(.user.login != "<pr-author>")] | last | .body' | grep -o 'review:sha=[0-9a-f]*' | tail -1`, with `<pr-author>` from `gh pr view <n> --json author -q .author.login`. Both filters are load-bearing: anyone can post a comment containing the marker text for any SHA they like, so an outside contributor's marker and the PR author's own (a member can be both) are never trusted as a completed review. The marker only narrows an interactive review; `--ci` ignores it.
 
 ## Inline review comments
 

package/template/package.json.tpl

@@ -13,6 +13,7 @@
     "gen:agents": "rulesync generate",
     "sync:agents": "node tools/sync-agents.mjs",
     "oss:worktree": "node tools/oss-worktree.mjs",
+    "review:precheck": "node tools/review-precheck.mjs",
     "prepare": "node tools/sync-agents.mjs && rulesync generate",
     "db:migrate": "pnpm -F @{{name}}/api exec openora-migrate",
     "db:seed": "pnpm -F @{{name}}/api db:seed",