Auto Review

Run the bundled structured review helper only when the user explicitly asks for autoreview, a second-model review, or one of its named review engines. This is code review, not Guardian auto_review approval routing.

Codex review is the default when no engine is set. It uses gpt-5.6-sol with high reasoning by default, then retries once with gpt-5.6-terra only when the account cannot access Sol. Claude review is optional and uses claude-fable-5 by default. Amp review is optional and uses openai/gpt-5.6-sol with high reasoning by default. Pi and Kimi use the model configured by their respective CLIs unless --model overrides it.

Do not invoke Autoreview automatically before a commit, push, PR, merge, deploy, or final reply. Repository or workflow rules may call it only when they explicitly name it.

Contract

• Default accepted findings are P0 only: report issues worth blocking the current change because they materially break the normal flow, outcome, or safety boundary. Use --max-priority P1, P2, or P3 only when the caller explicitly asks for a wider review.
• Treat review output as advisory. Never blindly apply it.
• Verify every finding by reading the real code path and adjacent files.
• Read dependency docs/source/types when the finding depends on external behavior.
• Reject unrealistic edge cases, speculative risks, unrelated rewrites, and fixes that over-complicate the codebase.
• Prefer root-cause fixes at the right ownership boundary. A coherent refactor is appropriate when it removes the bug class, duplicate policy, stale paths, or ownership confusion; do not default to a symptom patch.
• When an accepted finding exposes a bug class or repeated pattern, inspect its owner and relevant sibling implementations before fixing.
• Fix the same bug class across its owner-boundary neighborhood when practical; stop at unrelated invariants, different owners, and unapproved contract changes.
• Run one bounded review pass. If an accepted finding changes code, run the smallest relevant test; rerun Autoreview only when the user explicitly requests another pass.
• For security-audit suppression changes, verify accepted findings remain auditable: suppressed findings stay in structured output, active output keeps an unsuppressible suppression notice, and aggregate findings cannot hide unrelated active risk.
• Never switch or override the requested review engine/model except for the documented Codex Sol-to-Terra account-access fallback. Capacity, rate-limit, and unrelated failures keep the same engine/model.
• Be patient with large bundles. Structured review can take up to 30 minutes while the model call is active, especially with Codex tools or web search.
• Treat heartbeat lines like review still running: ... elapsed=... pid=... as healthy progress, not a hang. Let the helper continue while heartbeats are advancing. Pass --stream-engine-output when live engine text is useful; Codex and Claude filter tool/file chatter, other runnable engines pass raw output through.
• Do not kill a review just because it has been quiet for 2-5 minutes, or because it is still running under the 30-minute window. Inspect the process only after missing multiple expected heartbeats, after 30 minutes, or after an obviously failed subprocess; prefer letting the same helper command finish.
• Tools are useful in review mode. Codex receives the validated bundle in an empty workspace so ignored files and linked-worktree metadata remain unreadable; web search stays available for dependency contracts and upstream docs.
• Security perspective is always included, but it should not cripple legitimate functionality. Report security findings only when the change creates a concrete, actionable risk or removes an important safety check.
• Reviewer subprocesses preserve engine authentication and non-credentialed proxy variables needed by headless or restricted-network environments while stripping process-injection, Git override, and credentialed proxy values.
• Immediately before every provider call, autoreview writes the exact outgoing review pack to an owner-only temporary file and scans it with TruffleHog using verified,unknown. It uses the installed binary with --no-update to disable self-update checks and attempts. The scan covers prompt and dataset inputs, untracked content, and every diff line, including deleted lines. A finding, scanner error, or missing TruffleHog binary refuses the send and names the implicated repository file when it can be resolved; credentials are never redacted and forwarded. Security-sensitive paths remain omitted. Safe large diffs are sent as one pass while they fit the aggregate prompt limit, then partitioned into complete bounded passes without truncation.
• Regression provenance needs patch proof, not blame alone. git log -S/-G, git blame, commit subjects, and PR metadata locate candidates. Before saying introduced by, inspect raw parents with git --no-replace-objects cat-file -p <sha> and verify the implicated behavior changed in git --no-replace-objects diff --no-ext-diff --no-textconv <raw-parent> <sha> -- <path>; a genuine root needs raw-header proof that it has no parents.
• Blame ^sha, porcelain boundary, and shallow/grafted history alone are not introduction proof. --root can hide boundary markers; git show or rev-list --parents can make a shallow boundary look like a root. An available raw parent permits explicit comparison even at a shallow boundary; missing parents or an unverifiable patch require unknown with the gap. Use carried forward only for verified preexisting behavior and made visible only for a verified trigger. Apply the same bar to finding prose, summaries, and owner hints.
• Keep code author, introducing PR author, merger, committer, automation trigger, and current PR author separate; none of those roles alone proves causation. Cite the verified commit/PR/date. If no PR is traceable, use the verified commit and known author identity; unknown identities stay unknown, and missing PR metadata is not a separate finding.
• For automation merges, identify the human trigger only from explicit timeline/comment/event evidence, such as a maintainer automerge command or arming label. Report automerge triggered by @login only when verified; otherwise say trigger unknown. Triggering or merging is not proof of authorship or introduction.
• Do not invoke built-in codex review, nested reviewers, or review panels from inside the review. The helper builds one validated bundle, calls the selected engine once for normal inputs or once per complete bounded chunk for oversized inputs, validates the structured results, and stops.
• Stop as soon as the helper exits 0 with no accepted/actionable findings. Do not run an extra review just to get a nicer "clean" line, a second opinion, or clearer closeout wording.
• Treat scoped-clean with exit 0 as clean only for the selected Git target and requested priority. filtered is not a correctness certificate; incomplete requires resolving the scope mismatch or missing required finding before claiming clean.
• If rejecting a finding as intentional/not worth fixing, add a brief inline code comment only when it explains a real invariant or ownership decision that future reviewers should know.
• If gh/Gitcrawl reports database disk image is malformed, run gitcrawl doctor --json once to let the portable cache repair before retrying review; do not bypass the shim unless repair fails and freshness requires live GitHub.
• If Gitcrawl reports a portable manifest mismatch, source/runtime DB health error, or stale portable-store checkout, run gitcrawl doctor --json and inspect source_db_health, runtime_db_health, and portable_store_status before falling back to live GitHub.
• Do not push just to review. Push only when the user requested push/ship/PR update.

Scope

Autoreview does not expand the task. Fix only verified blockers in the requested path. Mention unrelated findings without opening a new workstream, and stop when the requested review pass is complete.

Skill Path (set once)

Set the skill script paths once, then use "$AUTOREVIEW" and "$AUTOREVIEW_HARNESS" in the examples below.

Choose one:

# Project-local skill in the current repo for Codex and other agents:
export AUTOREVIEW=".agents/skills/autoreview/scripts/autoreview"
export AUTOREVIEW_HARNESS=".agents/skills/autoreview/scripts/test-review-harness"

# Claude Code project-local skill in the current repo:
export AUTOREVIEW=".claude/skills/autoreview/scripts/autoreview"
export AUTOREVIEW_HARNESS=".claude/skills/autoreview/scripts/test-review-harness"

# Source checkout of openclaw/agent-skills:
export AUTOREVIEW="skills/autoreview/scripts/autoreview"
export AUTOREVIEW_HARNESS="skills/autoreview/scripts/test-review-harness"

# Global skill:
export AGENTS_HOME="${AGENTS_HOME:-$HOME/.agents}"
export AUTOREVIEW="$AGENTS_HOME/skills/autoreview/scripts/autoreview"
export AUTOREVIEW_HARNESS="$AGENTS_HOME/skills/autoreview/scripts/test-review-harness"

When using Claude Code, set AGENTS_HOME="$HOME/.claude" for global skills.

On native Windows, choose the matching pair:

# Project-local skill in the current repo for Codex and other agents:
$AUTOREVIEW = ".agents\skills\autoreview\scripts\autoreview"
$AUTOREVIEW_HARNESS = ".agents\skills\autoreview\scripts\test-review-harness.ps1"

# Claude Code project-local skill in the current repo:
$AUTOREVIEW = ".claude\skills\autoreview\scripts\autoreview"
$AUTOREVIEW_HARNESS = ".claude\skills\autoreview\scripts\test-review-harness.ps1"

# Source checkout of openclaw/agent-skills:
$AUTOREVIEW = "skills\autoreview\scripts\autoreview"
$AUTOREVIEW_HARNESS = "skills\autoreview\scripts\test-review-harness.ps1"

# Global skill:
$AgentsHome = if ($env:AGENTS_HOME) { $env:AGENTS_HOME } else { Join-Path $HOME ".agents" }
$AUTOREVIEW = Join-Path $AgentsHome "skills\autoreview\scripts\autoreview"
$AUTOREVIEW_HARNESS = Join-Path $AgentsHome "skills\autoreview\scripts\test-review-harness.ps1"

Pick Target

Dirty local work relative to HEAD:

"$AUTOREVIEW" --mode local

Without --base, this reviews HEAD-to-index, index-to-working-tree, and validated untracked files only. --mode auto selects the same HEAD-based scope when dirty; it does not include the committed PR merely because the checkout is on a PR branch. --mode uncommitted is an alias for --mode local. A clean local checkout without an explicit base has no local patch to review.

To review a dirty candidate against an explicit base, including a resolved merge that has not been committed:

"$AUTOREVIEW" --mode local --base origin/main

The helper pins that base to a commit at target selection. It reviews base-to-index changes and index-to-working-tree changes separately, plus validated untracked files. Only files identical across the base, index, and working tree are outside the change bundle; staged changes later undone remain included. Actual binary or submodule changes still refuse review. The bundle labels its pinned staged base. Git status remains relative to HEAD and does not define review scope. Without --base, local mode retains its usual HEAD-to-index behavior; it never infers a base from an in-progress merge.

Committed-only branch/PR work:

"$AUTOREVIEW" --mode branch --base origin/main

Branch mode reviews BASE...HEAD (merge-base-to-HEAD); staged, unstaged, and untracked changes are excluded even in a dirty checkout. To review the complete PR candidate including dirty rewrites, pin the PR merge base and use local mode:

pr_base=$(gh pr view --json baseRefName --jq .baseRefName)
merge_base=$(git merge-base HEAD "origin/$pr_base")
"$AUTOREVIEW" --mode local --base "$merge_base"

The remote base must already be available and current locally; the helper does not fetch. The pinned merge base avoids including unrelated upstream changes. Add --max-priority P2 when the caller requests P2 findings. An explicit --base also applies when auto selects local, but explicit local mode avoids changing targets when the checkout becomes clean.

Optional review context is first-class. Prompt files and datasets must be repo-relative so review bundles cannot pull arbitrary host files. Context never expands the selected Git target, even if it contains a complete candidate diff or asks to review the whole PR. Finding membership is checked by changed file, not individual hunk:

"$AUTOREVIEW" --mode branch --base origin/main --prompt-file review-notes.md --dataset evidence.json

If an open PR exists, use its actual base:

base=$(gh pr view --json baseRefName --jq .baseRefName)
"$AUTOREVIEW" --mode branch --base "origin/$base"

Committed single change:

"$AUTOREVIEW" --mode commit --commit HEAD

Use commit review for already-landed or already-pushed work on main. Reviewing clean main against origin/main is usually an empty diff after push. For a small stack, review each commit explicitly or review the branch before merging with --base. Commit review compares the raw recorded parent with the selected commit, ignoring replacement refs and legacy grafts. A genuine root compares against the empty tree. Missing parent objects stop review: explicitly deepen/fetch the needed history and rerun. The helper does not fetch it automatically.

Oversized Bundles

The helper validates the complete patch before partitioning it. For partitioned reviews it scans the complete frozen input first, so credentials cannot evade detection by crossing a chunk boundary. It also scans each exact outgoing review pack before sending it. A safe bundle that fits the aggregate prompt limit remains one integrated review pass. Larger bundles are split at bundle sections and file boundaries where possible; an oversized single-file block is split at line boundaries with repeated file/hunk context and an absolute new- or old-file line offset. Untracked snapshots use injection-safe source-line records so continuation passes retain reportable locations. A single physical diff line split across passes also retains its original addition, deletion, or context marker. Prompt instructions remain whole in every pass. Large datasets are grouped from their validated file records, never by reparsing headings inside evidence. Individual oversized datasets split at lines or UTF-8 boundaries with their original path and byte offset. Each evidence batch is paired with the complete change bundle: every original change byte appears exactly once per evidence batch, and every evidence byte is retained. All validated reports are merged before required-finding and exit-status checks. There is no fixed pass-count ceiling: the complete frozen input determines the finite pass sequence. The helper prints its size and pass count before running passes serially. Each pass retains the same prompt-size limit, secret scan, and reviewer isolation; a failed pass aborts without publishing a partial verdict.

Preparation prints immediate phase updates and periodic elapsed time to stderr, with file/byte counts during hashing and no filenames or contents. These updates are separate from provider heartbeats and do not count against engine deadlines. Bundle construction captures finding membership alongside validated text; normal and dry runs reuse that record without reopening untracked files for membership.

Dry runs reuse capture and scanning without whole-tree integrity sweeps. Real reviews retain full fresh tree hashing before bundle construction, before review, and before publication, including unrelated tracked files, nonignored untracked files, index state, and initialized submodules. Explicit prompt files and datasets also retain their own frozen bytes and raw path identities, regardless of Git ignore status or finding scope. They are revalidated before sending each pass and before publication; content changes, replacements, and leaf or ancestor symlink swaps refuse stale results. These endpoint checks are not atomic filesystem snapshots and cannot guarantee detection of transient changes restored between checks.

Evidence batches can multiply the pass count. Chunking cannot give one model call every cross-file implementation detail. For architecture-heavy changes, still prefer a coherent branch or PR shape whose semantic decision surface fits one pass. Removing verified non-authoritative generated noise remains useful, but never drop lockfiles, generated clients, policies, manifests, schemas, or other independently semantic artifacts merely to shrink the review.

Models and thinking

The helper accepts --model globally or per engine (engine=model) and --thinking globally or per engine (engine=level). Repeat either flag for multiple reviewers.

Recommended model defaults:

Engine	Default model	Source note
codex (default)	gpt-5.6-sol -> gpt-5.6-terra on access failure	OpenClaw org review default
claude	claude-fable-5	Anthropic's most capable widely released Claude model
amp	openai/gpt-5.6-sol	Amp structured-generation review default

CLI flags and environment variables override these defaults. Amp model IDs must use provider/model form. Pi and Kimi do not get built-in model defaults because their configured model catalogs may vary by installation.

Engine	Model flag	Example model IDs	Thinking flag	Accepted levels
codex (default)	codex --model X exec ...	gpt-5.6-sol, then gpt-5.6-terra on Sol access failure	-c model_reasoning_effort=Y	none, minimal, low, medium, high, xhigh, max
claude	claude --model X	claude-fable-5, claude-opus-4-8, claude-sonnet-4-6, claude-haiku-4-5	--effort Y	low, medium, high, xhigh, max
amp	Amp amp.ai.generate	openai/gpt-5.6-sol	reasoningEffort	none, low, medium, high, xhigh, max
pi	pi --model X	anthropic/claude-sonnet-4, openai/gpt-4o	--thinking Y	off, minimal, low, medium, high, xhigh
kimi	kimi --model X	A model alias from the user's Kimi config	[thinking] enabled in the staged config	on, off

Claude also supports --fallback-model a,b for availability-based fallback chains (model-config). Current Claude docs note that auth, billing, rate-limit, request-size, and transport errors do not trigger fallback, and the changelog documents interactive-session support in v2.1.166.

OpenAI's model guidance identifies Sol as the GPT-5.6 frontier-capability route and documents max support. Autoreview keeps high as its default; use max only for the hardest quality-first reviews after comparing its latency and cost with xhigh on representative changes.

Examples matching current main behavior:

# Codex with explicit model and reasoning
"$AUTOREVIEW" --engine codex --model gpt-5.6-sol --thinking high

# Codex fast mode (priority service tier); needs a model whose catalog lists the tier, silently standard otherwise
"$AUTOREVIEW" --engine codex --codex-speed fast

# Safe Codex model/response tuning overrides (--codex-speed wins over a service_tier here)
"$AUTOREVIEW" --engine codex --codex-config 'service_tier="fast"'

# Claude Code aliases or full model names, with optional availability fallback
"$AUTOREVIEW" --engine claude --model claude-fable-5 --thinking max
"$AUTOREVIEW" --engine claude --model claude-fable-5 --fallback-model claude-opus-4-8,claude-sonnet-4-6

# Amp direct structured generation (requires AMP_API_KEY)
"$AUTOREVIEW" --engine amp --model openai/gpt-5.6-sol --thinking high --amp-bin amp

# Pi with explicit model and thinking level
"$AUTOREVIEW" --engine pi --model anthropic/claude-sonnet-4 --thinking high --pi-bin pi

# Kimi with its configured default model, or a configured model alias
"$AUTOREVIEW" --engine kimi --thinking on --kimi-bin kimi
"$AUTOREVIEW" --engine kimi --model kimi-model-alias

Environment defaults

CLI flags take precedence over environment variables.

Store persistent personal defaults in your shell startup file or launcher environment. For repository-local defaults, use an existing local environment loader such as an untracked .envrc; the helper does not write a config file.

Variable	Purpose
AUTOREVIEW_MODEL	Override the built-in default --model for all engines
AUTOREVIEW_THINKING	Default --thinking for all engines
AUTOREVIEW_FALLBACK_MODEL	Default Claude --fallback-model chain
AUTOREVIEW_ENGINE_TIMEOUT_SECONDS	Optional positive wall-clock limit for each reviewer process; disabled by default
AUTOREVIEW_<ENGINE>_MODEL	Per-engine model override, for example AUTOREVIEW_CODEX_MODEL=gpt-5.6-sol
AUTOREVIEW_<ENGINE>_THINKING	Per-engine thinking override
AUTOREVIEW_CODEX_CONFIG	Safe Codex model/response tuning overrides, semicolon-separated, e.g. service_tier="fast"; capability-bearing keys fail closed
AUTOREVIEW_CODEX_SPEED	Codex service tier override: fast (priority), flex, or default; silently standard when the model does not list the tier
AUTOREVIEW_CLAUDE_FALLBACK_MODEL	Claude-only fallback chain
AUTOREVIEW_PROVIDER_ENV_ALLOW	Comma-separated custom Pi credential variable names; names must end in a recognized credential suffix
AMP_API_KEY	Required Amp API credential; file/keychain auth is intentionally excluded from the isolated runtime