feat(code-reviewer) Add council per repo webhook

[St0rmz1]

Summary

Adds per-repository opt-in for Council reviews on automated (webhook) pull
requests. A repository listed in the new council_enabled_repository_ids config
field runs the Council review type when its PRs are reviewed via webhook, using
the single org-level council config. Repositories not listed continue to get a
standard review. This is the path that lets a Council review run automatically on
a PR (trigger, execute, post the verdict, and drive the merge gate) rather than
only from a manual run.

Changes

• Config schema: add council_enabled_repository_ids to
  CodeReviewAgentConfigSchema (packages/db/src/schema-types.ts). Absent/empty
  means no repo runs Council automatically. Matched against the platform
  repository ID the same way as selected_repository_ids.
• Webhook trigger (pull-request-handler.ts): choose standard vs council per
  PR with determineAutomatedReviewType, gated on an active council config, the
  per-repo opt-in, and entitlement. The entitlement lookup is a DB call, so it
  only runs after the two cheap local checks pass; any missing condition falls
  back to standard so a bad or absent council config never blocks a review.
• Review type selection (worker-utils/code-review-council.ts): add
  determineAutomatedReviewType, returning council only when entitled, config
  active, and the repo opted in.
• Config UI (ReviewConfigForm.tsx, ReviewAgentPageClient.tsx): restructure
  the form into a Global Settings section (defaults every repo inherits) and a
  master "Advanced Settings" toggle that reveals per-repo overrides: repository
  selection, per-repo model, and per-repo Council toggles with a shared specialist
  picker. Add councilSelectionsFromConfig to hydrate the picker from a saved
  config.
• Routers (organization-code-reviews-router.ts, code-reviews-router.ts):
  expose and persist council and councilEnabledRepositoryIds in
  getReviewConfig/saveReviewConfig, with an entitlement guard that rejects
  saving an active council config for a non-entitled org.
• Finalize / status callback (finalize-council-result.ts,
  code-review-status/[reviewId]/route.ts): let the council result fall back to
  the org-level agent config for webhook reviews (which have no per-run manual
  config) via resolveOrgCodeReviewAgentConfig and an orgAgentConfig param.
  Automated council reviews drive the merge gate and post the council verdict
  section into the PR summary.
• Fix: the council review section no longer prints "No specialist raised a
  blocking finding" on a majority pass that actually had outvoted blocking votes;
  it now states the outvoted block count.
• Fix: Council opt-ins for repositories the user later deselects are dropped
  (intersected with the live selection) instead of persisting a stale ID that
  could keep the specialist picker open, block save on the minimum-specialist
  check, or silently re-activate Council if the repo is re-added.
• Tests added/updated for the review-type decision, the config round-trip, the
  picker hydration, the org-config fallback, and the verdict-section copy.

Verification

• Locally fired a signed GitHub pull_request webhook at a council-enabled,
  council-entitled org repo: confirmed it created a council review, executed,
  posted the verdict section plus inline comments, and set the merge gate check to
  failure (blocked). Pushed a fix and fired a synchronize webhook: confirmed a
  fresh council review ran, returned a pass decision, and flipped the gate check to
  success (unblocked).

Visual Changes

The code review config screen was restructured (Global Settings section + a master
Advanced Settings toggle exposing per-repo model and Council controls). Screenshots
to be added.

Before	After

Reviewer Notes

• determineAutomatedReviewType intentionally fails closed to standard, so any
  missing entitlement/config condition yields a normal review rather than an error.
• The entitlement DB lookup is deliberately behind the two local checks to keep the
  common (standard) webhook path from adding a query.
• Council remains a single org-level config; council_enabled_repository_ids only
  controls which repos opt that shared config into automated reviews. There is no
  per-repo specialist config in this PR.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

The previously flagged gating gap in ReviewConfigForm.tsx (line 615) is fixed: councilEnabledRepositoryIdsPayload is now gated by councilActiveForSave, the same condition used for councilPayload, so council and its per-repo opt-ins are always written or cleared together.

Files Reviewed (1 file)

• apps/web/src/components/code-reviews/ReviewConfigForm.tsx

Previous Review Summary (commit 3cc7822)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 3cc7822)

Status: 1 Issue Found | Recommendation: Address before merge

Executive Summary

A save-time gating gap in ReviewConfigForm.tsx can persist orphaned council_enabled_repository_ids after an unrelated save clears the council config.

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	0

Issue Details (click to expand)

WARNING

File	Line	Issue
apps/web/src/components/code-reviews/ReviewConfigForm.tsx	615	councilEnabledRepositoryIdsPayload isn't gated by councilUiEnabled like councilPayload is, so an unrelated save can persist stale repo opt-ins after council becomes null.

Files Reviewed (15 files)

• apps/web/src/app/(app)/organizations/[id]/code-reviews/ReviewAgentPageClient.tsx
• apps/web/src/app/api/internal/code-review-status/[reviewId]/route.ts
• apps/web/src/components/code-reviews/ReviewConfigForm.tsx - 1 issue
• apps/web/src/lib/code-reviews/core/council-selection.test.ts
• apps/web/src/lib/code-reviews/core/council-selection.ts
• apps/web/src/lib/code-reviews/council/finalize-council-result.test.ts
• apps/web/src/lib/code-reviews/council/finalize-council-result.ts
• apps/web/src/lib/integrations/platforms/github/webhook-handlers/pull-request-handler.test.ts
• apps/web/src/lib/integrations/platforms/github/webhook-handlers/pull-request-handler.ts
• apps/web/src/routers/code-reviews-router.ts
• apps/web/src/routers/organizations/organization-code-reviews-router.test.ts
• apps/web/src/routers/organizations/organization-code-reviews-router.ts
• packages/db/src/schema-types.ts
• packages/worker-utils/src/code-review-council.test.ts
• packages/worker-utils/src/code-review-council.ts

Fix these issues in Kilo Cloud

---

_{Reviewed by claude-sonnet-5 · Input: 24 · Output: 4.8K · Cached: 498.1K}

_{Review guidance: REVIEW.md from base branch main}