Prompt 04 — Personas e Relatório

Read SPEC.md — personas section is your reference.

You are building Prompt 04: add persona system prompts to the runner
generator and create the report consolidation script.

**Part A — Persona system prompts in write_runner:**

Update the write_runner helper in hooks/stop-hook.sh to inject a
persona-specific system prompt based on the current round:

Round 1 — Author persona:
"You are reviewing this PR as the AUTHOR of the code. Your job is to
verify that the implementation matches the stated intent in the PR
description. Look for: missing edge cases the description implies,
incomplete implementations, code that doesn't match the PR title.
Output ONLY a YAML list of findings."

Round 2 — Reviewer persona:
"You are a senior engineer reviewing this PR for correctness and
maintainability. Look for: logic errors, off-by-one errors, null
pointer risks, resource leaks, API misuse, missing error handling,
performance issues. Output ONLY a YAML list of findings."

Round 3 — Security persona:
"You are a security engineer reviewing this PR for vulnerabilities.
Look for: injection risks (SQL, command, path traversal), authentication
bypass, authorization gaps, sensitive data in logs, insecure defaults,
hardcoded secrets, SSRF vectors. Output ONLY a YAML list of findings."

**Part B — Structured findings schema:**

Each runner must instruct Claude to output findings as YAML only:
findings:
  - file: "relative/path/to/file.go"
    line: 42
    severity: HIGH        # CRITICAL|HIGH|MEDIUM|LOW
    persona: "Reviewer"
    description: "One sentence describing the issue"
    suggestion: "One sentence fix suggestion"

**Part C — generate-report.sh:**

Create `scripts/generate-report.sh <pr_number>`:
1. Read all findings from state/review.yaml
2. Group findings by file
3. Sort by severity (CRITICAL first)
4. Generate .claudex/reviews/PR-$pr_number.md with:
   - Header: # PR Review #NNN — [date]
   - Executive summary: N findings (X CRITICAL, Y HIGH, Z MEDIUM, W LOW)
   - Severity badges in header
   - Per-file sections with findings
   - Footer: "Generated by pr-reviewer plugin"
5. Create .claudex/reviews/ dir if not exists

**Call generate-report.sh from the SUMMARIZING phase in stop-hook.sh**
before transitioning to DONE.

**Constraints:**
- Personas must be injected in single-quoted heredocs (no interpolation)
- generate-report.sh must work even if findings list is empty
  (output "No findings" section in that case)
- Severity sort order: CRITICAL > HIGH > MEDIUM > LOW

**Verification:**
- Run the full loop on a test PR (use `--print` mock if needed)
- Check that .claudex/reviews/PR-NNN.md exists after SUMMARIZING
- Verify severity grouping is correct in the report
- Report: "X findings found, report saved to .claudex/reviews/PR-NNN.md"

# PR Review #123 — 2026-04-29 14:32 UTC

## Executive Summary
**3 findings** — 🔴 1 CRITICAL · 🟠 1 HIGH · 🟡 1 MEDIUM · ⚪ 0 LOW

---

## Findings by File

### `auth/token_handler.go`

#### 🔴 CRITICAL — Line 47
**Persona:** Security
**Issue:** Token transmitted without TLS enforcement check. If
`REQUIRE_HTTPS` is not set, tokens can be sent over plain HTTP.
**Suggestion:** Add `if !config.RequireHTTPS { return ErrInsecureConfig }`.

---

### `api/users.go`

#### 🟠 HIGH — Line 128
**Persona:** Reviewer
**Issue:** `db.Query()` result not checked for error before iterating.
**Suggestion:** `rows, err := db.Query(...); if err != nil { return err }`.

---

## Metrics
- Rounds completed: 3 (Author, Reviewer, Security)
- Files reviewed: 8
- Lines changed: 247
- Review duration: ~4m

---
*Generated by pr-reviewer plugin · Claude Code*