Prompt 05 — Safety Pass e Produção

Read SPEC.md — the safety invariants section is your audit checklist.

You are building Prompt 05: the safety pass.
Audit every script against the 6 primitives, then add GitHub
integration and repo configuration.

**Part A — Safety Audit (audit each file, fix what's missing):**

For every .sh file in the plugin, verify and fix:

1. ERR trap:
   - Present as FIRST active line?
   - Does it print to stderr and exit 0 (not exit 1)?
   - Fix any script where it's missing or exits non-zero.

2. Atomic writes:
   - Every write to state/review.yaml goes through write_state_atomic?
   - No direct `echo > state/review.yaml` anywhere?
   - Fix any direct writes found.

3. CAS on state transitions:
   - Every status change in stop-hook.sh uses cas_state?
   - Fix any status write that bypasses CAS.

4. Lockfile:
   - stop-hook.sh acquires lock at entry?
   - EXIT trap releases it?
   - Stale lock: add check — if lock exists but PID in it is dead, remove.
   - Implement: `if [ -f state/review.lock ]; then
     lock_pid=$(cat state/review.lock 2>/dev/null || echo "")
     if [ -n "$lock_pid" ] && ! kill -0 "$lock_pid" 2>/dev/null; then
       rm -f state/review.lock  # stale lock — safe to remove
     fi; fi`

5. Path validation:
   - All scripts that receive a path argument validate it starts
     with /tmp/pr-review- before using it.
   - Implement: `[[ "$WORKTREE_PATH" == /tmp/pr-review-* ]] ||
     { echo "Invalid path: $WORKTREE_PATH" >&2; exit 0; }`

6. Subprocess timeouts:
   - runner scripts use `timeout 120 claude --print` not bare `claude`.
   - Fix any runner that calls claude without timeout.

**Part B — GitHub Integration:**

In scripts/generate-report.sh, after saving the report file:

Read .claude/review-config.yaml (use `yq` or manual grep fallback).
If `post_to_github: true` (default true):
  `gh pr comment $PR_NUMBER --body-file .claudex/reviews/PR-$PR_NUMBER-*.md`

Handle gh failure gracefully (log error, don't abort).

**Part C — repo configuration:**

Create `.claude/review-config.yaml` with defaults:
max_rounds: 3
min_severity: MEDIUM    # CRITICAL|HIGH|MEDIUM|LOW — filter for gh comment
ignore_paths:           # paths to skip in diff
  - "*.lock"
  - "*.sum"
  - "vendor/"
timeout_seconds: 120    # per runner invocation
post_to_github: true

**Part D — E2E test script:**

Create `tests/e2e-test.sh <pr_number>`:
1. Assert: state is clean (no active review)
2. Invoke: `/pr-reviewer $pr_number` (simulate: set state=SETUP, run hook)
3. Assert: state transitions SETUP → REVIEWING (round 1)
4. Simulate 3 runner completions (inject mock findings)
5. Assert: state transitions to SUMMARIZING
6. Assert: report file created at .claudex/reviews/PR-$pr_number-*.md
7. Assert: gh pr comment was called (check with mock or --dry-run)
8. Assert: state is DONE, worktree removed

**Report after delivery:**
- List of fixes applied in Part A (by primitive)
- Confirm all 6 primitives now covered
- E2E test result: all 7 assertions PASS

# .claude/review-config.yaml
# PR Reviewer Configuration — customize for this repo

# Number of review rounds (1 = Author only, 2 = +Reviewer, 3 = +Security)
max_rounds: 3

# Minimum severity to include in the GitHub PR comment
# CRITICAL|HIGH|MEDIUM|LOW — lower severity findings still appear in local report
min_severity: MEDIUM

# Paths to skip in the diff (supports glob patterns)
ignore_paths:
  - "*.lock"
  - "*.sum"
  - "vendor/"
  - "*.generated.go"
  - "testdata/"

# Timeout per runner invocation (seconds)
timeout_seconds: 120

# Whether to post the report as a PR comment via gh
# Set false for OSS repos or when you prefer manual review of the report
post_to_github: true

# Override max diff size (lines) — diffs larger than this are split
max_diff_lines: 3000