An automated review pass on every merge, to narrow the no-second-reviewer gap #380

Cmdr has one developer, so no change gets a second pair of eyes before it lands. Security reviews ask about this ("Is every change reviewed by someone other than its author?"), and OpenSSF Scorecard's Code-Review check scores it 0. A small contribution to enterprise-readiness optics (#118); not committed to.

Idea

An automated review pass on every merge to main, with its findings recorded where a reviewer can see them:

• A workflow runs an AI code review (for example Claude Code's review, at a fixed effort level) on each pushed range, focused on the riskiest areas: the updater, the write engine, licensing, and the protocol parsers.
• It records each run: a check-run summary on the commit, plus an issue for each confirmed finding. That gives a security reviewer an audit trail: "every change is reviewed by an automated reviewer, findings are tracked".
• A human (David) triages the findings; the record shows what was fixed or accepted.

What it would and wouldn't change

• Questionnaires: we could honestly answer "every change gets an automated review, with tracked findings" instead of "no second reviewer". Most reviewers accept that from a solo vendor when it's documented.
• Scorecard: likely no change. Code-Review counts changes merged through a pull request with an approval from someone other than the author, and pushes straight to main don't qualify. Raising it would mean routing every change through a PR approved by a separate bot account, which a careful reviewer would read as a rubber stamp. Not recommended.

Cost

• API spend per push (sized by the diff), and CI minutes (free on the public repo).
• Triage time for findings, which is the real cost.

Size

S for the workflow and recording; ongoing triage time.

Decision needed

Whether to do it at all, and if so: on every push, or only on pushes touching the risky areas.