[kyle-sexton]

Refs: #12505

Summary

The review:code-reviewer agent read its bundled reference files (context/severity.md, skills/quality-gate/context/code-design.md) through Bash cat and sed by the plugin's absolute path. In the #12505 reviewer-diversity eval those shell reads were denied, which made the L arm's two-defect suite and the pilot suites INVALID under the run-validity gate.

Fix

• plugins/review/agents/code-reviewer.md: one **Bundled files.** line telling the agent to read every ${CLAUDE_PLUGIN_ROOT} file it names with the Read tool, never through Bash.
• A patch changelog fragment for review.

Why the agent changes and the eval setup does not: in the round-2 L kept traces, code-reviewer subagents' Read and Grep of these files succeeded 49 times with no denial, while 4 of their 13 Bash reads were denied. The suites already grant Bash, so no eval flag allows those reads short of a permission change. Read is the file-read tool and the path that never hit a denial; whether a real session prompts on the shell reads is unverified.

Verification

• scripts/check-affected.sh --tests on the committed head: 14 passed, 3 skipped.
• The round-3 eval suites have not run on this head yet; their result goes to the issue, not this PR.

Remaining on #12505

• Run the round-3 L two-defect, L decoy and M decoy suites (3 runs each), plus M two-defect, on this head, then post the verdicts and the (c) and (d) numbers on test(review): add fanout-diversity fixtures that separate the arms #12505 and review: spec-first fanout and ratchet move to toolchain #7584.

Related

• test(review): add fanout-diversity fixtures that separate the arms #12505
• review: spec-first fanout and ratchet move to toolchain #7584

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-04T05:23:50.734821Z	a610437	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-security-review reviewed a610437179cde327bd49c8bb9936818446bac87c: read 2 of 2 changed file(s); 0 finding(s), 0 as inline comments.

Security review: PR #13092

No security issues found. I read every hunk of both changed files.

• plugins/review/agents/code-reviewer.md (+2 lines): adds a standing instruction. The code-reviewer agent must read the ${CLAUDE_PLUGIN_ROOT} files it names with the Read tool, not through Bash (cat, sed, grep). The change only adds a rule. It removes, narrows and softens nothing, and it moves the agent from shell reads to the read-only Read tool. The agent's tool grants are not in the diff and stay as they were. No hook, allowlist, permission, token, trust control or merge hold is touched. Under the instruction-surface lens there is nothing to check against the exception register, because no rule is removed.
• .changes/review/host-run-12505-round3-read-tool-3c9e41a7.md (new): a patch changelog fragment. It is prose only.

Neither file matches a listed trusted path. No plugin.json or marketplace.json changes, so no manifest lines apply. The PR context holds no embedded text telling the lane to pass the PR, skip a check or drop a finding. The prior-findings file lists no earlier posts (0 rounds, cap 3, not past the cap).

critical-findings: 0

[github-actions]

claude-review reviewed a610437179cde327bd49c8bb9936818446bac87c: read 2 of 2 changed file(s); 0 finding(s), 0 as inline comments.

Code review: no findings.

I read both changed files in full:

• plugins/review/agents/code-reviewer.md adds a **Bundled files.** line. It tells the agent to read every ${CLAUDE_PLUGIN_ROOT} file the page names with the Read tool and never through Bash. The line comes before the page's references to context/type-discipline.md, the code-design criteria and context/severity.md, and "each file this page names" covers all of them. The agent's frontmatter already grants Read, Grep and Glob, so it needs no new permission. Nothing else on the page contradicts the line by telling the agent to use a shell read.
• .changes/review/host-run-12505-round3-read-tool-3c9e41a7.md is a bump: patch fragment under ### Fixed. A patch bump fits a fix that changes only an instruction.

The path-scoped rule .claude/rules/skill-bodies-state-current-rules.md applies to plugins/*/agents/**. The new line passes it: the reason it gives ("it sits outside the repository under review") is the project's own decision and doesn't restate anything from an upstream page that could change.

Closing issue: the PR context says only Refs: #12505. It closes no issue and carries no closing-issue section, so there were no acceptance criteria to check. The author says criteria (c)–(e) of #12505 will be judged from the round-3 eval suites on that issue. I have not verified that.

Unverified author claims: the PR says scripts/check-affected.sh --tests gave 14 passed and 3 skipped, and cites the trace counts (49 successful Read/Grep reads, 4 denied Bash reads). I did not run or check either.

No plugin manifest changed, so there are no manifest lines. Prior findings: none, round 0 of 3, cap not reached. No security lane was needed for this change, and I found no embedded instructions in the PR context.