review v0.15.1+v0.15.2 shipped a false claim: the code-review marketplace plugin does exist (regression on main from #1326 and #1351)

[kyle-sexton]

Filed by the autonomous babysit merge lane (AI-generated). This documents a factual regression that has already landed on main.

What shipped

PR #1326 merged at 2026-07-25T21:12Z (merge commit 5796bb60), shipping review plugin v0.15.1. It asserts, in two places on main, that no installable code-review marketplace plugin exists:

plugins/review/skills/quality-gate/context/pr.md:

Boundary — two built-in/managed surfaces, neither a marketplace plugin

Two Claude Code surfaces overlap this mode's job on an open PR. Neither is an installable claude-plugins-official marketplace plugin — both ship with Claude Code itself

plugins/review/README.md:

Graceful degrade. The optional pr-review-toolkit orchestrator plugin (from the official marketplace) adds adversarial breadth when installed [...] Claude Code's bundled /code-review command and the managed Code Review GitHub App service are separate built-in/managed surfaces, not marketplace plugins

Both statements are false.

The evidence

Verified twice this session directly against the marketplace source, most recently after the merge:

$ gh api repos/anthropics/claude-plugins-official/contents/.claude-plugin/marketplace.json
   → plugin names matching "review": ['code-review', 'pr-review-toolkit']

   {'name': 'code-review',
    'description': 'Automated code review for pull requests using multiple specialized
                    agents with confidence-based scoring to filter false positives',
    'author': {'name': 'Anthropic', 'email': 'support@anthropic.com'},
    'source': './plugins/code-review',
    'category': 'productivity',
    'homepage': 'https://github.com/anthropics/claude-plugins-public/tree/main/plugins/code-review'}

plugins/code-review/commands/code-review.md exists in that repo and defines /code-review:code-review. Its own documented steps: launch 5 parallel Sonnet agents to review independently, score each finding 0-100 for confidence via Haiku agents, filter the low-confidence ones, post via gh pr comment.

That is exactly the behavior the deleted pr.md section described. The documentation removed by #1326 was accurate.

Note the shape of the error: code-review and pr-review-toolkit sit side by side in the same marketplace.json, same author, same category: productivity. The repo now documents one of that pair as real and the other as nonexistent.

Three surfaces exist, not two

1. The installable code-review@claude-plugins-official plugin — /code-review:code-review. Real. Deleted by docs(review): reconcile stale code-review framing in quality-gate pr.md and README #1326.
2. The bundled built-in /code-review command — invoked bare, no install. Real; docs(review): reconcile stale code-review framing in quality-gate pr.md and README #1326 discovered and documented it correctly.
3. The managed Code Review GitHub App — org-level service, posts inline comments. Real; docs(review): reconcile stale code-review framing in quality-gate pr.md and README #1326 discovered and documented it correctly.

#1326 found (2) and (3), wrote a genuinely good Boundary section for them, and then wrongly concluded (1) does not exist.

What was and was not fixed before merge

The merge lane escalated this on both #1326 and #1351 at 18:37Z, naming two defects. One was fixed, one was not:

• ✅ Fixed. The bare-/code-review mutation misclassification. pr.md on main now correctly reads: "Bare /code-review <target> is not gated: it reports into the session and writes nothing to the PR or the working tree." Good — that matches the official docs.
• ❌ Not fixed. The core false premise. It merged as written.

Suggested remedy

• Restore surface (1) in plugins/review/skills/quality-gate/context/pr.md and plugins/review/README.md: the orchestrator bullet naming code-review alongside pr-review-toolkit, and the /code-review:code-review description.
• Keep the corrected Boundary section for surfaces (2) and (3), and keep the corrected mutation gate — both are real improvements.
• Retitle the Boundary heading, which currently asserts the false claim in the heading text itself.
• Ship as v0.15.2 with a CHANGELOG entry recording the correction, since v0.15.1's own entry states the false premise as its rationale.

Still open and compounding

PR #1351 (docs/1325-reconcile-code-review-framing-fanout) carries the same claim into plugins/review/skills/fanout/SKILL.md:

Boundary — built-in/managed surfaces, not marketplace plugins

Neither is an installable claude-plugins-official marketplace plugin

and its orchestrator roster is reduced to pr-review-toolkit + codex, with code-review removed. It received the same partial fix at 2ff0a9d9 (bare-command classification corrected) but not the premise fix. It is currently CONFLICTING. The merge lane is holding it and will not merge it.

Items #732 and #1325 encode the premise upstream and are labeled needs-human. Correcting only the PRs will let this be re-derived from the same brief.

Process note

This is the second time in one session that green CI plus a clean deterministic merge gate would have landed a factually wrong contract-surface change — and this time it did land, because the merge came from a lane that did not have the escalation in its context. CI validates structure, not truth. The claude-review bot also ran on #1326 at 21:08Z, after the escalation comment was posted, and did not surface the premise dispute.

Deliberately filed without a work-class label; that classification belongs to triage.

[kyle-sexton]

Cross-ref: the merge lane's original escalations are on #1326 (merged despite it) and #1351 (still held). Upstream items #732 and #1325 carry the premise and are labeled needs-human.

[kyle-sexton]

This was generated by AI during triage.

Verified. Reproduced both parts of the claim directly against origin/main this session:

1. The review plugin's PR-mode boundary section and its README currently assert no installable
   code-review marketplace plugin exists. Confirmed present on origin/main in exactly the shape
   quoted in the issue body.
2. Queried anthropics/claude-plugins-official's marketplace.json directly (fresh gh api call,
   not cached): a code-review plugin entry exists side by side with pr-review-toolkit, same
   author, same category. The claim in (1) is factually false.

Both facts check out independently of the issue's own evidence. This is a confirmed regression, not
a disputed claim.

Agent Brief

Type: Bug
Summary: The review plugin's PR-review-mode documentation and README currently claim a real,
installable marketplace code-review plugin does not exist. It does. Restore accurate coverage of
all three overlapping review surfaces without regressing the two corrections the same documentation
change got right.

Current behavior:
The PR-mode boundary section and the plugin README each describe only two review surfaces on an
open PR — a bundled built-in command and a managed GitHub App service — and state neither is an
installable marketplace plugin. That framing is incomplete: a third surface, the installable
code-review marketplace plugin (an independent multi-agent PR reviewer, distinct from both), also
exists and was silently dropped from this documentation.

Desired behavior:
The same documentation names and correctly distinguishes all three overlapping surfaces: the
installable marketplace code-review plugin, the bundled built-in command, and the managed GitHub
App service. The two corrections already present and accurate — the bundled command's non-mutating
default behavior, and the managed App's built-in/managed status — are preserved as-is. Any section
heading whose wording itself asserts the false two-surfaces framing is reworded to match the
restored three-surface reality. The change ships with a version bump and a changelog entry stating
the correction and citing the regression.

Acceptance criteria:

• The PR-mode boundary section and the plugin README both name the installable marketplace
  code-review plugin as a real, distinct surface alongside the bundled command and the managed
  App service.
• No heading or prose anywhere in the changed files still asserts that only two surfaces exist,
  or that no installable marketplace review plugin exists.
• The two behavioral corrections already accurate in the current docs (bundled command's
  non-mutating default; managed App's built-in/managed nature) read unchanged in substance.
• The plugin's version is bumped and its changelog gains an entry describing the correction.
• Existing tests for the changed plugin still pass.

Out of scope:

• The still-open, separately-tracked upstream classification questions on docs(review): reconcile stale code-review framing in quality-gate pr.md and README #732 and docs(review): reconcile stale code-review framing in fanout SKILL.md + findings-normalization.md #1325 — this
  brief only restores accurate surface-count framing in the two files the regression already landed
  in, it does not re-derive the deeper policy those items own.
• PR docs(review): reconcile stale code-review framing in fanout SKILL.md + findings-normalization.md #1351 — a different open PR from another lane, currently conflicting and held under that
  lane's own management. Do not touch it; a corrected review v0.15.1+v0.15.2 shipped a false claim: the code-review marketplace plugin does exist (regression on main from #1326 and #1351) #1402 fix may or may not resolve its conflict
  as a side effect, but that is out of scope here.
• Any change to which review agents/skills exist or how they're invoked — this is a documentation
  correctness fix, not a capability change.

---

Work-loop admission note. Triage classification: briefed, delegable (no open decision — the
fix is a factual restoration, not a design choice). Risk-property read: bounded blast radius (two
doc files), trivially reversible, verifiability via existing plugin tests plus CI — this is C3
scoped-change shaped. This lane's own durable state has first_drain_complete: false and this item
carries no prior ratification, so per the admission gate's first-drain rule it is queued, not
dispatched, pending either an operator ratification reply or first-drain completion. Applied
needs-human (not agent-ready) for that reason — not because a human decision on scope is open.

[kyle-sexton]

Update — the regression is larger than first filed, and both upstream items are now closed.

PR #1351 also merged, at 2026-07-25T22:45:37Z (commit 7e070ef8), shipping review v0.15.2. It carried the same premise, and it merged while holding the do-not-merge label — that bypass is tracked separately in #1409.

Corrected blast radius on main

The false claim now appears in five files, not two:

File	Where	Landed in
plugins/review/skills/quality-gate/context/pr.md	line 7	v0.15.1 (#1326)
plugins/review/README.md	"Graceful degrade" bullet	v0.15.1 (#1326)
plugins/review/skills/fanout/SKILL.md	lines 91, 93 — the heading asserts it too	v0.15.2 (#1351)
plugins/review/skills/fanout/context/findings-normalization.md	line 20	v0.15.2 (#1351)
plugins/review/CHANGELOG.md	the 0.15.1 and 0.15.2 entries state it as their rationale	both

Additionally, per the v0.15.2 CHANGELOG entry, two fanout evals (pr-comment-gate-opt-in and the renamed unscored-surface-severity-derived-not-invented) were updated to match the removed framing. The correction has to reach those too, or the evals will assert the false premise back into place.

plugins/review/.claude-plugin/plugin.json is now at 0.15.2.

Both upstream items auto-closed with the premise intact

• docs(review): reconcile stale code-review framing in quality-gate pr.md and README #732 — closed 21:12:32Z by the docs(review): reconcile stale code-review framing in quality-gate pr.md and README #1326 merge. Labels still include needs-human and work-class: mechanical.
• docs(review): reconcile stale code-review framing in fanout SKILL.md + findings-normalization.md #1325 — closed 22:45:38Z by the docs(review): reconcile stale code-review framing in fanout SKILL.md + findings-normalization.md #1351 merge. Same.

Neither was corrected before closing. Reopening them, or filing superseding items, is the way to stop this being re-derived from the same brief — which is exactly how #1351 came to repeat #1326's error independently.

Re-verified after both merges

anthropics/claude-plugins-official → marketplace.json still lists both code-review and pr-review-toolkit, same author, same category: productivity. plugins/code-review/commands/code-review.md still defines /code-review:code-review. The claim is false as of this comment.

Revised remedy

Restore surface (1) across all five files and the two evals; keep the Boundary sections and the bare-/code-review mutation-gate correction (both are genuine improvements); retitle the fanout Boundary heading; ship as v0.15.3 with a CHANGELOG entry recording the correction, since both prior entries cite the false premise as their rationale.

[kyle-sexton]

This was generated by AI, delegated directly by the repository operator to resolve this blocker.

RATIFIED for autonomous dispatch. The earlier ratify-c3 escalation comment on this item is
stale — its brief scopes the fix to 2 files, which was accurate when written and is not accurate
against origin/main today. Do not implement from it. The Agent Brief below supersedes it.

This pass re-derived the scope from the current state of origin/main
(dc9aa77b55138ec8cf21229b2d7a8d1ffb3200f3) rather than from either prior comment's file list. Both
merge commits are confirmed present on origin/main: 5796bb60 (#1326, v0.15.1) and 7e070ef8
(#1351, v0.15.2).

What was re-verified this pass

Fresh gh api repos/anthropics/claude-plugins-official/contents/.claude-plugin/marketplace.json,
this session:

• code-review → ./plugins/code-review, category: productivity
• pr-review-toolkit → ./plugins/pr-review-toolkit, category: productivity

plugins/code-review/.claude-plugin/plugin.json exists in that repo (author Anthropic, description
"Automated code review for pull requests using multiple specialized agents with confidence-based
scoring") and plugins/code-review/commands/code-review.md exists, defining /code-review:code-review.

The installable marketplace code-review plugin is real. The original claim in this issue holds.

Scope limit on this verification — read before implementing. Only surface (1) was re-verified.
The descriptions of surface (2) (the bundled built-in /code-review command) and surface (3) (the
managed Code Review GitHub App service) are carried forward from #1326's research and were not
re-checked against official docs in this pass. They are preserved because nothing here contradicts
them, not because they were confirmed. The implementer re-verifies them — see the acceptance
criteria.

Corrected blast radius — 7 files, not 5

The prior update comment listed 5 files and referred to "two fanout eval files". Both counts
are off. gh pr view 1351 --json files shows #1351 touched exactly one evals file containing
two cases, and neither prior comment lists the plugin manifest.

File	What is wrong with it today
plugins/review/skills/quality-gate/context/pr.md	Heading (line 5) asserts "two built-in/managed surfaces, neither a marketplace plugin"; body (lines 7–8) says "Two Claude Code surfaces overlap this mode's job... Neither is an installable claude-plugins-official marketplace plugin". Surface (1) is absent and the enumeration is presented as complete.
plugins/review/README.md	"Graceful degrade" bullet (lines 61–66). Its sentence about the bundled command and the managed App is literally true; the defect is that code-review was dropped from the optional-orchestrator roster, leaving pr-review-toolkit + codex only. Omission, not a false sentence — plus a name collision that reads as a denial.
plugins/review/skills/fanout/SKILL.md	Line 86: "Two optional orchestrator plugins" (was "Three"); the code-review bullet was deleted. Line 91 heading and line 93 have the same true-sentence/complete-enumeration problem as pr.md.
plugins/review/skills/fanout/context/findings-normalization.md	The parse-contract table row | code-review plugin | none (flat issue list) | 0–100, filters <80 | GitHub permalink #L[s]-L[e] | was deleted. Line 20's "Not in this table" note is true of the two built-in/managed surfaces but points at a heading that asserts the complete-enumeration framing. Stage-1's "Surfaces emitting no severity" rule lost its only example.
plugins/review/CHANGELOG.md	The only flatly false assertion left on main: the 0.15.2 entry says the fanout skill "described the same nonexistent plugin". The 0.15.1 entry states the same premise as its rationale ("neither is an installable marketplace plugin", framed as the correction being made).
plugins/review/skills/fanout/evals/evals.json	Case id 6 pr-comment-gate-opt-in — its expected_output and expectations were narrowed to /code-review --comment + the managed service only. With code-review restored as a dispatched orchestrator, the PR-mutation gate must again cover its comment-posting mode; as written this eval would assert the narrowed contract back into place. Case id 11 (unscored-surface-severity-derived-not-invented) is discussed under Out of scope.
plugins/review/.claude-plugin/plugin.json	Currently 0.15.2. Needs the version bump. Listed by neither prior comment.

Agent Brief

Type: Bug (documentation correctness regression already on main)

Summary: Across the review plugin, the enumeration of review surfaces that overlap an open PR
was reduced to two — a bundled built-in command and a managed GitHub App service — and presented as
complete. A third surface, the installable code-review plugin in the claude-plugins-official
marketplace, is real and was dropped. Restore it everywhere the surfaces are enumerated, without
regressing the corrections the same two changes got right.

Current behavior:
Every place in the review plugin that enumerates PR-review surfaces names exactly two, and its
headings, counts, and framing present that enumeration as exhaustive. The fanout skill's
orchestrator roster and its findings-normalization parse-contract table no longer carry
code-review at all, so it is neither dispatched nor parseable. The changelog states as fact that
the plugin does not exist.

Desired behavior:
Every enumeration of PR-review surfaces names all three: the installable marketplace code-review
plugin (/code-review:code-review), the bundled built-in /code-review command, and the managed
Code Review GitHub App service. code-review is again a dispatched fanout orchestrator with a
parse contract and a PR-mutation gate covering its comment-posting mode. No heading, count, or prose
anywhere states or implies that no installable code-review marketplace plugin exists. The
changelog gains a 0.15.3 entry recording the correction and naming the two prior entries whose
stated rationale was false — prior entries are corrected by the new entry, not rewritten.

Acceptance criteria:

• Invariant, not a string hunt: every location that enumerates PR-review surfaces enumerates
  all three, and no text anywhere in plugins/review/ states or implies that no installable
  code-review marketplace plugin exists. Headings and counts ("two", "Two optional orchestrator
  plugins", "neither is a marketplace plugin") are part of this — a true sentence that frames a
  two-item list as complete still fails.
• plugins/review/skills/fanout/SKILL.md restores the code-review orchestrator bullet and its
  count, and findings-normalization.md restores the code-review parse-contract row.
• Concrete completion signal: findings-normalization.md's Stage-1 rule "Surfaces emitting
  no severity → DERIVE from content" currently has no referent — every remaining table row
  carries a native severity. Restoring the code-review row (native severity: none; confidence:
  0–100, filters <80; line basis: GitHub permalink) makes that rule live again. If that rule
  still has no referent after the change, the restoration is incomplete.
• evals.json case id 6 pr-comment-gate-opt-in is updated so the PR-mutation gate it asserts
  covers /code-review:code-review's comment-posting mode alongside /code-review --comment and
  the managed service.
• plugins/review/CHANGELOG.md gains a 0.15.3 entry that records the correction and explicitly
  names the 0.15.1 and 0.15.2 entries as having stated a false premise. Do not rewrite the
  historical entries.
• plugins/review/.claude-plugin/plugin.json is bumped to 0.15.3.
• Fresh-docs re-verification, in the implementer's own session (this is a manifest change, so
  the repo's fresh-docs mandate applies, and the ratification above deliberately did not cover
  surfaces 2 and 3): re-run
  gh api repos/anthropics/claude-plugins-official/contents/.claude-plugin/marketplace.json
  before restoring surface (1), and WebFetch https://code.claude.com/docs/en/code-review before
  restating the bundled command's behavior. Cite both in the PR. If either contradicts this
  brief, stop and escalate rather than implementing.
• Must survive the change — do not blanket-revert docs(review): reconcile stale code-review framing in quality-gate pr.md and README #1326/docs(review): reconcile stale code-review framing in fanout SKILL.md + findings-normalization.md #1351. Three things in the current
  text are independent of the regression and stay: bare /code-review <target> remains
  ungated (report-only; only --fix and --comment mutate); the managed Code Review GitHub
  App service description stays; and codex stays in the README's optional-orchestrator roster
  (added by docs(review): reconcile stale code-review framing in fanout SKILL.md + findings-normalization.md #1351, unrelated).
• Existing review plugin evals and CI checks still pass.

Out of scope:

• evals.json case id 11. Its rename to unscored-surface-severity-derived-not-invented and its
  genericized prompt are not false — a generic "a dispatched surface with no native severity" is
  more robust than naming one plugin. Keep the rename. Re-adding code-review as the illustrative
  example is optional, not required.
• plugins/review/skills/quality-gate/context/code.md. Its "Boundary — the built-in
  /code-review skill" section predates this regression (docs(review): document quality-gate vs bundled /code-review boundary #266/docs(review): document quality-gate code mode vs built-in /code-review boundary #735) and concerns only the bundled
  command. Leave it alone unless the invariant above forces a wording touch.
• docs(review): reconcile stale code-review framing in quality-gate pr.md and README #732 and docs(review): reconcile stale code-review framing in fanout SKILL.md + findings-normalization.md #1325. Both are closed, auto-closed by the two merges with the premise intact.
  Reopening or filing superseding items was not authorized in this ratification. Note only: once
  main is correct, the re-derivation risk drops sharply. File a separate item if that residual risk
  is judged worth tracking.
• loop-lane: cross-lane PR hold was undefined — escalating lane explained-then-held, and the do-not-merge label landed 3m20s after #1351 merged #1409 (the do-not-merge bypass on docs(review): reconcile stale code-review framing in fanout SKILL.md + findings-normalization.md #1351) — separate item, separate concern.
• Any capability change. This is a documentation-correctness fix. Do not change which agents or
  skills exist, or how any of them are invoked, beyond restoring code-review to the orchestrator
  roster and the parse table as they read before docs(review): reconcile stale code-review framing in fanout SKILL.md + findings-normalization.md #1351.

---

Admission note. Ratified as C3 / work-class: scoped: documentation-only, blast radius bounded
by the 7 files above, trivially reversible, verifiable by the plugin's existing evals plus the
concrete Stage-1-referent signal. Labels updated to agent-ready + work-class: scoped (it carried
no work-class label at all, which would have blocked admission even with agent-ready);
needs-human removed. Eligible for /work-items:work pickup.

[kyle-sexton]