feat(review): add /review:quality-gate code-design mode

.changes/review/feat-8329-quality-gate-code-design-mode-4c7d2e91.md

@@ -0,0 +1,7 @@
+---
+bump: minor
+---
+
+### Added
+
+- `/review:quality-gate code-design` reviews a change for design that makes the next change costly. It loads the consumer's review criteria through the standards resolution ladder and falls back to small bundled criteria (Duplicated Code, Shotgun Surgery, Speculative Generality), run by a fresh-context `review:brief-reviewer`. Repetition is CRITICAL only when the diff introduces a copy in code that no shared source or sync check keeps aligned, and the finding names the repeated fact and the later change that would make the copies diverge; Markdown repetition, change cascades and the `prototype` quality bar stay SUGGESTION. A consumer standard that contradicts a bundled default wins, and the report says `Overrides bundled default <principle> per <standards file>`; with no quality bar given, the review rates as production and says so. The mode takes the phase-boundary inputs like every other.

plugins/review/evals/qg-code-design-cascade/case.yaml

@@ -0,0 +1,4 @@
+schema_version: "1.1"
+name: qg-code-design-cascade
+context:
+  scaffold_script: scaffold.sh

plugins/review/evals/qg-code-design-cascade/graders/brief-reviewer-dispatched.md

@@ -0,0 +1,5 @@
+---
+type: tool_used
+tool: Agent
+input_match: '"subagent_type"\s*:\s*"(?:review:)?brief-reviewer"'
+---

plugins/review/evals/qg-code-design-cascade/graders/critical-names-threshold.md

@@ -0,0 +1,4 @@
+---
+type: regex
+pattern: '(?:^|\n)[ \t>]*(?:(?:[-*+]|\d+[.)])[ \t]+)?(?:#+[ \t]+)?\**CRITICAL\b(?![ \t]*\**[ \t]*\d)[^\n]*(?:FREE_SHIPPING_THRESHOLD|(?<![:\d])\b50\b)|(?:\|[ \t]*\**CRITICAL\**[ \t]*\||[(\[][ \t]*\**CRITICAL\**[ \t]*[)\]]|\bSeverity\**[ \t]*[:=][ \t]*\**CRITICAL\b|\b(?:is|are)[ \t]+\**CRITICAL\b|(?<!not )\brated[ \t]+(?:as[ \t]+)?\**CRITICAL\b)[^\n]*(?:FREE_SHIPPING_THRESHOLD|(?<![:\d])\b50\b)|(?:FREE_SHIPPING_THRESHOLD|(?<![:\d])\b50\b)[^\n]*(?:\|[ \t]*\**CRITICAL\**[ \t]*\||[(\[][ \t]*\**CRITICAL\**[ \t]*[)\]]|\bSeverity\**[ \t]*[:=][ \t]*\**CRITICAL\b|\b(?:is|are)[ \t]+\**CRITICAL\b|(?<!not )\brated[ \t]+(?:as[ \t]+)?\**CRITICAL\b)'
+---

plugins/review/evals/qg-code-design-cascade/graders/names-diverging-change.md

@@ -0,0 +1,7 @@
+---
+type: llm
+---
+
+PASS if the review rates as CRITICAL (or blocking) that the change copies the free-shipping threshold: src/cart/banner.js and src/checkout/summary.js each hardcode 50 instead of importing FREE_SHIPPING_THRESHOLD from src/pricing.js. The finding must name that repeated fact, point at the copies, and name the later change that makes them diverge, such as raising or lowering the threshold in src/pricing.js while the banner keeps promising, or the summary keeps charging by, the old 50. It must give a fix that removes the copies, such as importing the constant.
+
+FAIL if the review approves the change; rates the hardcoded threshold IMPORTANT, SUGGESTION or lower; flags only the magic number without naming the copy of FREE_SHIPPING_THRESHOLD; names no later change that would make the copies disagree; or proposes keeping both copies in step by hand instead of one shared source.

plugins/review/evals/qg-code-design-cascade/graders/names-production-assumption.md

@@ -0,0 +1,5 @@
+---
+type: regex
+pattern: '\bproduction\b[^\n]{0,80}\b(?:(?:assume[sd]?|assuming|assumptions?)|default\w*|none given|not given|no quality bar)|\b(?:(?:assume[sd]?|assuming|assumptions?)|default\w*|none given|not given|no quality bar)\b[^\n]{0,80}\bproduction\b'
+flags: i
+---

plugins/review/evals/qg-code-design-cascade/graders/no-edit.md

@@ -0,0 +1,6 @@
+---
+type: tool_used
+tool: Edit
+min: 0
+max: 0
+---

plugins/review/evals/qg-code-design-cascade/prompt.md

@@ -0,0 +1,13 @@
+---
+description: "The branch hardcodes the free-shipping threshold 50 in two new files instead of importing FREE_SHIPPING_THRESHOLD, with no quality bar given: the code-design review rates the introduced, unsynced copy CRITICAL, names the fact and the change that would make the copies diverge, and says it assumed production"
+tags: [review, quality-gate, code-design, repetition]
+runs: 3
+max_turns: 40
+timeout_seconds: 900
+allowed_tools: [Read, Glob, Grep, Skill, Agent, Bash, Write, Edit]
+expected_outcome: "The gate dispatches review:brief-reviewer and reports as CRITICAL that src/cart/banner.js and src/checkout/summary.js each hardcode 50, a copy of FREE_SHIPPING_THRESHOLD in src/pricing.js, so raising the threshold there leaves the banner and the summary promising or charging the old amount; the fix imports the constant. The report says the quality bar was assumed to be production because none was given, and nothing is edited"
+---
+
+I added a free-shipping banner and a checkout summary on this branch.
+
+Run `/review:quality-gate code-design` on this branch with `--base` set to the SHA in `.review-base` and `--report-only`, and give me the report.

plugins/review/evals/qg-code-design-cascade/samples/brief-reviewer-dispatched.json

@@ -0,0 +1,62 @@
+{
+  "pass": [
+    {
+      "answer": [
+        {
+          "tool": "Agent",
+          "input": {
+            "description": "Code-design review",
+            "prompt": "You are reviewing a change for code design. Concern: code-design.",
+            "subagent_type": "review:brief-reviewer"
+          }
+        }
+      ],
+      "why": "the plugin's brief reviewer"
+    },
+    {
+      "answer": [
+        {
+          "tool": "Agent",
+          "input": {
+            "description": "Review",
+            "prompt": "Concern: code-design.",
+            "subagent_type": "brief-reviewer"
+          }
+        }
+      ],
+      "why": "unprefixed agent name"
+    }
+  ],
+  "fail": [
+    {
+      "answer": [],
+      "why": "reviewed on the invoking thread"
+    },
+    {
+      "answer": [
+        {
+          "tool": "Agent",
+          "input": {
+            "description": "Review",
+            "prompt": "Review the design.",
+            "subagent_type": "general-purpose"
+          }
+        }
+      ],
+      "why": "a general-purpose agent can fan out"
+    },
+    {
+      "answer": [
+        {
+          "tool": "Agent",
+          "input": {
+            "description": "Review",
+            "prompt": "Review the code.",
+            "subagent_type": "review:code-reviewer"
+          }
+        }
+      ],
+      "why": "wrong reviewer for the code-design mode"
+    }
+  ]
+}

plugins/review/evals/qg-code-design-cascade/samples/critical-names-threshold.json

@@ -0,0 +1,34 @@
+{
+  "pass": [
+    {
+      "answer": "| 1 | CRITICAL | high | Duplicated Code | banner.js and summary.js hardcode 50, a copy of FREE_SHIPPING_THRESHOLD | src/cart/banner.js:2 | Import the constant |",
+      "why": "CRITICAL row naming the threshold"
+    },
+    {
+      "answer": "Copying the threshold 50 into banner.js is CRITICAL: changing pricing.js leaves it stale.",
+      "why": "prose finding"
+    }
+  ],
+  "fail": [
+    {
+      "answer": "",
+      "why": "empty reply"
+    },
+    {
+      "answer": "| 1 | SUGGESTION | medium | Duplicated Code | 50 hardcoded in banner.js | src/cart/banner.js:2 | Import FREE_SHIPPING_THRESHOLD |",
+      "why": "rated below CRITICAL"
+    },
+    {
+      "answer": "| 1 | IMPORTANT | high | Duplicated Code | threshold 50 copied | src/checkout/summary.js:4 | Import it |",
+      "why": "rated IMPORTANT"
+    },
+    {
+      "answer": "| 1 | CRITICAL | high | Missing Tests | The new free-shipping threshold banner has no test | src/cart/banner.js:2 | Add a test |",
+      "why": "CRITICAL about something else that only mentions the threshold"
+    },
+    {
+      "answer": "No code-design issues found.\n\nCRITICAL 0, IMPORTANT 0, SUGGESTION 0",
+      "why": "approves"
+    }
+  ]
+}

plugins/review/evals/qg-code-design-cascade/samples/names-diverging-change.json

@@ -0,0 +1,22 @@
+{
+  "pass": [
+    {
+      "answer": "| 1 | CRITICAL | high | Duplicated Code | src/cart/banner.js:2 and src/checkout/summary.js:4 hardcode 50, a copy of FREE_SHIPPING_THRESHOLD (src/pricing.js:1). Raising the threshold to 75 in pricing.js would leave the banner promising free shipping at $50 and the summary charging nothing below $75's rule. No shared source or test keeps them aligned. | src/cart/banner.js:2 | Import FREE_SHIPPING_THRESHOLD in both files |",
+      "why": "fact, copies, diverging change, fix"
+    }
+  ],
+  "fail": [
+    {
+      "answer": "No code-design issues found.",
+      "why": "approves"
+    },
+    {
+      "answer": "| 1 | SUGGESTION | medium | Magic number | 50 is a magic number | src/cart/banner.js:2 | Name it |",
+      "why": "magic number only, below CRITICAL"
+    },
+    {
+      "answer": "| 1 | CRITICAL | high | Duplicated Code | 50 is copied from pricing.js into banner.js and summary.js | src/cart/banner.js:2 | Keep the three values in step |",
+      "why": "no diverging change and a manual-sync fix"
+    }
+  ]
+}

plugins/review/evals/qg-code-design-cascade/samples/names-production-assumption.json

@@ -0,0 +1,26 @@
+{
+  "pass": [
+    {
+      "answer": "Quality bar: production (assumed: none given)",
+      "why": "the mode's own line"
+    },
+    {
+      "answer": "No quality bar was passed, so I rated against production.",
+      "why": "names the assumption in prose"
+    }
+  ],
+  "fail": [
+    {
+      "answer": "",
+      "why": "empty reply"
+    },
+    {
+      "answer": "Quality bar: production",
+      "why": "states the bar without saying it was assumed"
+    },
+    {
+      "answer": "| 1 | CRITICAL | high | Duplicated Code | threshold copied | src/cart/banner.js:2 | Import it |",
+      "why": "no quality-bar line at all"
+    }
+  ]
+}

plugins/review/evals/qg-code-design-cascade/samples/no-edit.json

@@ -0,0 +1,34 @@
+{
+  "pass": [
+    {
+      "answer": [],
+      "why": "edits nothing"
+    },
+    {
+      "answer": [
+        {
+          "tool": "Read",
+          "input": {
+            "file_path": "src/cart/banner.js"
+          }
+        }
+      ],
+      "why": "reads only"
+    }
+  ],
+  "fail": [
+    {
+      "answer": [
+        {
+          "tool": "Edit",
+          "input": {
+            "file_path": "src/cart/banner.js",
+            "old_string": "a",
+            "new_string": "b"
+          }
+        }
+      ],
+      "why": "fixes the finding instead of reporting it"
+    }
+  ]
+}

plugins/review/evals/qg-code-design-cascade/scaffold.sh

@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+# main holds a shop whose free-shipping threshold is FREE_SHIPPING_THRESHOLD in src/pricing.js. The
+# branch adds a cart banner and a checkout summary that each hardcode the same 50 instead of importing
+# it, and no test ties the copies together. The base commit SHA is in .review-base.
+set -euo pipefail
+
+git init -q -b main
+git config user.name eval
+git config user.email eval@example.invalid
+printf '.review-base\n' >>.git/info/exclude
+mkdir -p src/cart src/checkout
+
+cat >src/pricing.js <<'JS'
+export const FREE_SHIPPING_THRESHOLD = 50;
+export const SHIPPING_FEE = 4.99;
+
+export function shippingFor(subtotal) {
+  return subtotal >= FREE_SHIPPING_THRESHOLD ? 0 : SHIPPING_FEE;
+}
+JS
+
+cat >package.json <<'JSON'
+{ "name": "shop", "type": "module", "private": true }
+JSON
+
+git add .
+git commit -q -m "feat: shipping fee"
+git rev-parse HEAD >.review-base
+git checkout -q -b feat/cart-banner
+
+cat >src/cart/banner.js <<'JS'
+export function freeShippingBanner(subtotal) {
+  const remaining = 50 - subtotal;
+  if (remaining <= 0) {
+    return "You get free shipping!";
+  }
+  return `Add $${remaining.toFixed(2)} more for free shipping on orders over $50.`;
+}
+JS
+
+cat >src/checkout/summary.js <<'JS'
+import { SHIPPING_FEE } from "../pricing.js";
+
+export function summaryLines(subtotal) {
+  const shipping = subtotal >= 50 ? 0 : SHIPPING_FEE;
+  return [
+    `Subtotal: $${subtotal.toFixed(2)}`,
+    `Shipping: ${shipping === 0 ? "free" : "$" + shipping.toFixed(2)}`,
+    `Total: $${(subtotal + shipping).toFixed(2)}`,
+  ];
+}
+JS
+
+git add src
+git commit -q -m "feat: free-shipping banner and checkout summary"

plugins/review/evals/qg-code-design-markdown/case.yaml

@@ -0,0 +1,4 @@
+schema_version: "1.1"
+name: qg-code-design-markdown
+context:
+  scaffold_script: scaffold.sh

plugins/review/evals/qg-code-design-markdown/graders/brief-reviewer-dispatched.md

@@ -0,0 +1,5 @@
+---
+type: tool_used
+tool: Agent
+input_match: '"subagent_type"\s*:\s*"(?:review:)?brief-reviewer"'
+---

plugins/review/evals/qg-code-design-markdown/graders/markdown-repetition-is-suggestion.md

@@ -0,0 +1,4 @@
+---
+type: regex
+pattern: '^(?![\s\S]*(?:(?:^|\n)[ \t>]*(?:(?:[-*+]|\d+[.)])[ \t]+)?(?:#+[ \t]+)?\**(?:CRITICAL|IMPORTANT)\b(?![ \t]*\**[ \t]*\d)[^\n]*(?:\b(?:setup|deploy|README)\.md\b)|(?:\|[ \t]*\**(?:CRITICAL|IMPORTANT)\**[ \t]*\||[(\[][ \t]*\**(?:CRITICAL|IMPORTANT)\**[ \t]*[)\]]|\bSeverity\**[ \t]*[:=][ \t]*\**(?:CRITICAL|IMPORTANT)\b)[^\n]*(?:\b(?:setup|deploy|README)\.md\b)|(?:\b(?:setup|deploy|README)\.md\b)[^\n]*(?:\|[ \t]*\**(?:CRITICAL|IMPORTANT)\**[ \t]*\||[(\[][ \t]*\**(?:CRITICAL|IMPORTANT)\**[ \t]*[)\]]|\bSeverity\**[ \t]*[:=][ \t]*\**(?:CRITICAL|IMPORTANT)\b)))[\s\S]*(?:\bSUGGESTION\b[^\n]*\b(?:setup|deploy|README)\.md\b|\b(?:setup|deploy|README)\.md\b[^\n]*\bSUGGESTION\b)'
+---

plugins/review/evals/qg-code-design-markdown/graders/names-node-requirement.md

@@ -0,0 +1,7 @@
+---
+type: llm
+---
+
+PASS if the review reports, as a SUGGESTION, that docs/setup.md and docs/deploy.md each restate the README's requirement of Node.js 20 or later, and proposes keeping the fact in one place, such as linking to the README instead of repeating the version.
+
+FAIL if the review reports nothing about the repeated Node.js requirement; rates it CRITICAL, IMPORTANT or blocking; or flags a different repetition (the npm commands) as the only finding.

plugins/review/evals/qg-code-design-markdown/graders/no-edit.md

@@ -0,0 +1,6 @@
+---
+type: tool_used
+tool: Edit
+min: 0
+max: 0
+---

plugins/review/evals/qg-code-design-markdown/prompt.md

@@ -0,0 +1,13 @@
+---
+description: "A Markdown-only branch restates the README's Node.js 20 requirement in two new docs pages: the code-design review reports the repetition as SUGGESTION, never CRITICAL or IMPORTANT"
+tags: [review, quality-gate, code-design, repetition, markdown]
+runs: 3
+max_turns: 40
+timeout_seconds: 900
+allowed_tools: [Read, Glob, Grep, Skill, Agent, Bash, Write, Edit]
+expected_outcome: "The gate dispatches review:brief-reviewer and reports that docs/setup.md and docs/deploy.md each restate the README's Node.js 20 requirement, rated SUGGESTION because the copies are Markdown, with a pointer to the README as the fix. No finding about them is CRITICAL or IMPORTANT, and nothing is edited"
+---
+
+I wrote setup and deploy guides on this branch.
+
+Run `/review:quality-gate code-design` on this branch with `--base` set to the SHA in `.review-base` and `--report-only`, and give me the report.