Add pr-review skill codifying the inline-first PR review method

[habdelra]

Our GitHub Copilot plan with unlimited PR reviews is ending, so automated review coverage moves to Claude. For that to work as a real replacement, reviews need to be consistent in shape and quality no matter who invokes them — which means the method has to live in a skill rather than in any one person's practice.

This adds a pr-review skill that encodes the review method:

• Context before judgment — read the full PR discussion first (bot findings are treated as leads and verified before being repeated), check out the head branch read-only in a worktree, and read the code surrounding the diff, since the highest-value findings usually live one call site away from it.
• Verified claims — every behavioral claim is traced through the actual code path and, where checkable, verified empirically (query plans, small repros, executed tests), with the evidence pasted into the comment. Hedged phrasing in a draft is a to-do marker, not a comment.
• Classified findings — each comment states whether it is a regression, a pre-existing bug the PR now builds on, a follow-up, or a confirmation documenting why a trade-off is safe and the conditions under which it would stop being safe. Blocking vs. non-blocking is carried in prose; the review always submits as COMMENT, so approve/request-changes stays a human decision.
• Inline-first placement — line-anchored comments for critique against contiguous lines, file-level comments for whole-file concerns, and the review body for cross-cutting or architectural feedback and for answering open discussion questions.
• Re-reviews continue the conversation — when the author responds to a comment with changes, the re-review diffs since the last reviewed commit, verifies each fix against the actual commits with the same rigor as the first pass, and lands its critique as a threaded reply in the author's thread rather than as a new comment. Background a thread already explains is not repeated; the reply picks up at the thread's altitude.
• Written for an unfamiliar author — comments carry the mechanism with real file and symbol names, the evidence, a concrete way out, and background on why the surrounding machinery exists, so an author new to that part of the codebase can act without a follow-up question.
• Standing checks in both directions — the pr-privacy, evergreen-comments, and pr-comment-attribution contracts apply both to the diff under review and to the review's own prose.

This also pre-approves the most common read-only tool calls (lint/typecheck runs, CI-artifact downloads, Linear reads, screenshots) in the project Claude settings, so reviews and other Claude flows run autonomously instead of pausing on permission prompts for read-only work. The aws entry is bounded server-side by the read-only IAM role its profile assumes.

Documentation and settings only; no runtime surface.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 52cd20298b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

Pull request overview

This PR adds a new Claude skill, pr-review, intended to standardize how pull request reviews are performed and written (inline-first, evidence-backed, and evergreen).

Changes:

• Add .claude/skills/pr-review/SKILL.md defining the PR review workflow and comment-writing rubric.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.