feat: implement issue #1091 — [Phase 2] Issue-type classifier + specialist deep-review prompts via the rubric registry

[don-petry]

Closes #1091

Implemented by dev-lead agent. Please review.

Summary by CodeRabbit

• New Features

  • Added specialized deep-review workflows for security, logic, performance, and maintainability concerns.
  • Deep reviews are now automatically routed based on triage classification.
  • Added standardized review outcomes with risk levels, escalation decisions, and structured findings.
  • Reviews can incorporate safety checks and downstream-impact information when available.
  • Added safe fallback behavior when classifications or specialist workflows are unavailable.

• Tests

  • Added comprehensive coverage for classification, routing, fallback behavior, registry mappings, and workflow integration.
  • Included the new specialist-routing tests in the lint workflow.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

Warning

Review limit reached

@don-petry, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 55 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 06d353f8-ed33-4def-94fa-f6e12ffe94ae

📥 Commits

Reviewing files that changed from the base of the PR and between 9918cc2 and 034d855.

📒 Files selected for processing (1)

• .github/workflows/lint.yml

📝 Walkthrough

Walkthrough

Adds issue-type classification to triage and routes Tier 2 reviews to logic, performance, security, or style specialist prompts through registry-backed resolution, with fallback behavior and offline Bats coverage.

Changes

Deep specialist routing

Layer / File(s)	Summary
Triage classification contract prompts/triage.md	Triage output now includes one dominant security, logic, performance, or style type.
Specialist prompt contracts prompts/deep-review-*.md	New specialist prompts define scoped review procedures, risk decisions, escalation rules, and JSON output schemas.
Registry-backed Tier 2 dispatch scripts/lib/deep-specialist.sh, scripts/review-one-pr.sh, scripts/lib/README.md	Type labels are normalized and resolved through registry mappings, with fallback to the generic deep prompt and deterministic context-file exports.
Routing validation and CI wiring tests/test_deep_specialist.bats, .github/workflows/lint.yml	Tests cover classification, resolution, fallback, registry behavior, and script wiring; lint runs the new test suite.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Possibly related issues

• Org Status — 2026-07-07 .github#622 — Covers the same issue-type classifier and specialist deep-review routing initiative.
• Org Status — 2026-07-08 .github#625 — Directly relates to registry-backed specialist prompt selection.
• Org Status — 2026-07-06 .github#621 — Aligns with the classifier and specialist deep-review objective.

Possibly related PRs

• petry-projects/.github-private#704 — Introduces the Bats runner used by the workflow change.
• petry-projects/.github-private#746 — Also changes Tier 2 prompt and output resolution in scripts/review-one-pr.sh.

Suggested labels: needs-human-review

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: issue-type classification and specialist deep-review prompt routing for issue #1091.
Linked Issues check	✅ Passed	The PR adds classifier routing, specialist prompts, registry-based selection, and fallback/tests that match the issue goals.
Out of Scope Changes check	✅ Passed	All listed changes support the classifier/routing work; no unrelated functionality appears in the summary.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev-lead/issue-1091-20260714-0427

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gemini-code-assist]

Code Review

This pull request implements an issue-type classifier and specialist deep-review routing. The triage tier now classifies escalated diffs into one of four categories (security, logic, performance, or style) and routes the deep review to a corresponding specialist prompt resolved via the rubric registry, with a fallback to the monolithic deep review prompt. Feedback on the pull request identifies that the newly added specialist prompts expect the SAFETY_CHECKS_FILE and DOWNSTREAM_IMPACT_FILE environment variables to be set, but these are not currently exported in scripts/review-one-pr.sh. A code suggestion is provided to export these variables if the corresponding files exist.

[don-petry]

Dev-Lead — review-changes (applied)

Changes committed and pushed.

[Copilot]

Pull request overview

Implements Phase 2 of #1091 by adding an issue-type classifier output to the triage tier and using rubric-registry data to route the deep-review tier to specialist prompts (security/logic/performance/style), with a safe fallback to the existing monolithic prompts/deep-review.md.

Changes:

• Extend triage output contract to include a type label and define classification guidance in prompts/triage.md.
• Add registry-driven deep-tier prompt routing via deep_specialist:<type> entries and a new scripts/lib/deep-specialist.sh helper, wired into scripts/review-one-pr.sh.
• Add specialist deep-review prompt variants and bats coverage, and include the new test in the lint workflow.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tests/test_deep_specialist.bats	Adds bats coverage for type normalization, triage extraction, registry resolution, and fallback behavior.
scripts/review-one-pr.sh	Wires in classifier-based deep-tier prompt selection (registry-driven) and logs the chosen specialist.
scripts/lib/review-registry.tsv	Registers deep_specialist:<type> → specialist prompt mappings as data (no hardcoded switch).
scripts/lib/README.md	Documents the new deep_specialist:<type> registry convention and fallback behavior.
scripts/lib/deep-specialist.sh	Implements normalization, triage .type extraction, and registry-based specialist prompt resolution with fallback.
prompts/triage.md	Adds classifier instructions and updates triage JSON output schema to include "type".
prompts/deep-review-style.md	Introduces style/maintainability specialist deep-review prompt.
prompts/deep-review-security.md	Introduces security specialist deep-review prompt (aligned with security-audit lens).
prompts/deep-review-performance.md	Introduces performance/scalability specialist deep-review prompt.
prompts/deep-review-logic.md	Introduces logic/correctness specialist deep-review prompt.
.github/workflows/lint.yml	Adds the new bats test file to the lint workflow’s bats job list.

[don-petry]

Dev-Lead — review-changes (applied)

Changes committed and pushed.

[don-petry]

Dev-Lead — waiting on PR blockers (intent: fix-reviews)

PR: #1223
No changes were committed, but the PR still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews). The retry cron will re-attempt automatically. Next attempt after: 2026-07-14T05:28:31Z

[don-petry]

Dev-Lead — waiting on PR blockers (intent: review-changes)

PR: #1223
No changes were committed, but the PR still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews). The retry cron will re-attempt automatically. Next attempt after: 2026-07-14T06:35:28Z

[don-petry]

Note

@don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically.
Next attempt after: 2026-07-14T06:35:28Z

[don-petry]

Dev-Lead — waiting on PR blockers (intent: review-changes)

PR: #1223
No changes were committed, but the PR still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews). The retry cron will re-attempt automatically. Next attempt after: 2026-07-14T06:45:58Z

[don-petry]

Note

@don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically.
Next attempt after: 2026-07-14T06:45:58Z

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[don-petry]

Dev-Lead — fix-bot-comment (no-changes)

Agent reasoning

1. **Gemini Code Assist (RESOLVED)**
   - **Finding**: Specialist deep-review prompts expect `SAFETY_CHECKS_FILE` and `DOWNSTREAM_IMPACT_FILE` environment variables
   - **Fix**: scripts/review-one-pr.sh lines 915–921 — added file-existence guards that export both variables when their corresponding files exist, placed right before Tier 2 launch
   - **Status**: ✅ Resolved (don-petry replied at 04:48:12Z and 04:58:16Z with confirmations)
2. **Copilot Pull Request Reviewer (RESOLVED, OUTDATED)**
   - **Finding**: ShellCheck word-splitting warning in deep-specialist.sh
   - **Fix**: scripts/lib/deep-specialist.sh line 30 — converted `DEEP_SPECIALIST_CLASSES` from a word-split string to a bash array, updated loop to use proper `"${array[@]}"` expansion
   - **Status**: ✅ Resolved (don-petry replied at 04:53:50Z)
**CI Status**: All critical checks passing or in-progress; no blockers detected.
**No changes needed** — all identified issues have been addressed, verified, and resolved.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: MEDIUM
Reviewed commit: 034d8556b388f5a6e0bce2acd00277f91ab4dd6e
Review mode: triage-approved (single reviewer)

Summary

Implements the Phase-2 issue-type classifier: triage now emits a type label in {security, logic, performance, style}, and the deep tier routes to a specialist prompt resolved data-driven via deep_specialist: rows in the rubric registry, with a tested fallback to prompts/deep-review.md. Confirms the triage-approved assessment; risk noted as MEDIUM (touches the review pipeline) but all gates pass.

Linked issue analysis

Closes #1091. AC1 (classifier in triage output), AC2 (one specialist prompt per class), AC3 (registry-driven routing via review-registry.tsv + deep-specialist.sh, no switch in review-one-pr.sh), and AC4 (fallback on ambiguous/missing label, missing registry row, or missing prompt file) are all implemented and covered by 16 bats tests. AC5 (holdout eval no-regression) is not evidenced in the PR body, but the holdout-guard CI check passed.

Findings

• No blocking findings.
• Security: the LLM-produced `type` label is whitelist-normalized (`normalize_diff_type`) before any shell use, and `resolve_deep_specialist` verifies the specialist file exists under the repo root before routing — no injection surface.
• The added `SAFETY_CHECKS_FILE`/`DOWNSTREAM_IMPACT_FILE` export block closes a latent gap: main's comments claimed these paths were exported for the deep/audit tiers, but no export statement existed. Slightly beyond #1091 scope, but correct and beneficial.
• Minor (info): AC5 eval-run results are not documented in the PR body; consider noting holdout scores in future phase PRs.
• Both prior review threads (gemini-code-assist, copilot) are resolved; CodeRabbit approved.
• Secret scan: MCP run_secret_scanning tool unavailable in this run; gitleaks CI check passed.

CI status

All required checks green (agent-shield, SonarCloud, CodeQL, dependency-audit). shellcheck, ShellCheck, bats, unit-tests, Lint, gitleaks, holdout-guard, prompt-coverage, template-drift all SUCCESS. The two CANCELLED entries (dev-lead / dispatch, dev-lead / ci-relay) are non-required dev-lead automation relays, not blocking.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.