Rig Review

Read Evidence rules. This workflow is read-only; it never writes to GitHub.

Input

• workspace (default): staged and unstaged changes.
• path <path>: one file or directory.
• commit <rev>: a committed range.
• pr <number|url>: optional PR mode when gh is authenticated.

Workflow

1. Classify. TRIVIAL, LOCAL, BROAD, or HIGH_RISK. Risk categories set depth; they do not grant execution authority.
2. Start the run. rig_evidence with action: "start", skill: "rig-review", and the exact target paths.
3. Collect exact source. Record the diff and the complete bytes of every reviewed file. For workspace, prefer a detached review worktree so later edits cannot silently change the evidence. A digest change invalidates the review.
4. Select axes. correctness is mandatory and must be run (cannot be omitted). Add security for auth, credentials, deserialization, or network input; tests when behavior changes; api for public interfaces; performance, docs, and data when the diff warrants. Cap at four axes below BROAD. Also ensure coverage records what was actually inspected for correctness.
5. Dispatch independent reviewers. Use rig-reviewer (or rig_dispatch). Give each only the task, role card, exact source digests, and assigned axis. Reviewers are read-only and return JSON findings; the parent never counts its own reading as reviewer evidence.
6. Validate findings. Reject any finding without a concrete file and observed evidence. De-duplicate by signature (file + invariant), not by wording. Use rig_findings with action: "write", the axes, the coverage, and reviewer naming the independent reviewer(s). That write records the review evidence bound to the scope digest.
7. Report. Order by severity. State the axes that ran, the axes that did not, and why. An honest partial review beats a fabricated complete one.
8. Finalize. rig_evidence with action: "finalize". Open findings are a valid review outcome; they are not a completion failure. Source drift is: start a new review instead of certifying changed bytes.

Rules

• Never write to the repository or GitHub during review.
• Do not fix findings here; hand them to rig-remediate.
• A finding must cite source that was actually read; pattern-matched suspicion is labeled as suspicion.
• If an independent reviewer is unavailable, say so and cap confidence; do not substitute the parent's own analysis.

Output

Report run ID, scope digest, axes run and skipped, findings by severity, coverage limits, and confidence.