fix(fd3,code-review): 2026-09-25 run tuning and headless code review in the implement workflow

plugins/code-review/CHANGELOG.md

@@ -7,6 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+
+- Headless skills for workflow callers — `cr-prepare` (scope, conventions, standards and the
+  active lens set, written to a context directory), `cr-scan` (one lens) and `cr-merge` (one
+  report, every finding returned with its fix-risk class). Model-only, they ask nothing and edit
+  nothing in the checkout, and an empty change or a missing lens returns a status, never a clean
+  review
+- `get_changes.py -C <checkout>` reviews another checkout without changing directory
+- Eval-20 runs the headless pipeline against a git sandbox
+
 ### Changed
 
 - Author metadata now reads `Mateusz Gostański <mg@grixu.dev>` in `plugin.json` and the marketplace entry.

plugins/code-review/README.md

@@ -35,6 +35,22 @@ partial review, invoke `/comment-review` or `/quality-review` directly; both sta
 independently available and share the same rule text as the command. The three
 added lenses have no standalone skill.
 
+### Headless skills for workflows
+
+A workflow agent cannot answer questions or dispatch agents of its own, so `/start-cr`
+cannot run there. Three model-only skills (hidden from the `/` menu) split the same
+pipeline into steps a caller orchestrates, all eight lenses included:
+
+| Skill | Arguments | Writes |
+|---|---|---|
+| `code-review:cr-prepare` | `--base <ref> --out <dir> [-C <checkout>] [--spec <path>]` | `scope.json`, `conventions.md`, `standards.md` |
+| `code-review:cr-scan` | `--lens <lens> --context <dir>` | `<lens>.md` — run one per active lens, each as its own agent |
+| `code-review:cr-merge` | `--context <dir>` | `report.md`, and returns every finding with its fix-risk class |
+
+None of them edits the checkout or asks anything. An empty change, a lens that did not
+report or a missing lens file comes back as a status, never as a clean review.
+`fd3`'s implementation workflows are the first caller.
+
 The report groups by **file**, with the two vocabularies side by side — comment
 verdicts (`R1`–`R12` · KEEP/REMOVE/REWRITE/MOVE/ADD) and quality findings
 (`` `family` · rule · severity `` across eleven families: `readability`, `tests`,

plugins/code-review/evals/README.md

@@ -23,8 +23,15 @@ evals/
   prompts/standards.txt    # quality trigger with the standards fixture dir as repo root
   fixtures/                # inputs; fixtures/spec/ and fixtures/standards/ are multi-file
   scope-mix/               # eval-19 input, kept out of fixtures/ so its paths classify by kind
+  prompts/headless.txt     # cr-prepare → cr-scan × N → cr-merge, in that order — headless track
+  checks/                  # deterministic asserts that read files on disk (headless track)
+  reset-sandbox.sh         # rebuilds .sandbox/headless, the git checkout eval-20 reviews
 ```
 
+The headless skills review committed changes only, so eval-20 runs against a git
+checkout rather than a fixture path; `scripts/run-evals.sh code-review` rebuilds it
+before every run.
+
 Node dev deps (`@anthropic-ai/claude-agent-sdk` + `promptfoo`) and the run
 scripts live at the **repo root** (`package.json`, single shared `node_modules`),
 not per-plugin.

plugins/code-review/evals/checks/headless-pipeline.mjs

@@ -0,0 +1,46 @@
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const LENSES = ['comments', 'readability-tests', 'naming-module', 'objects-patterns', 'simplicity-types', 'security', 'performance', 'spec'];
+const FINDING = /^- (high|medium|nit) · [\w-]+ · [\w-]+ · \S+:L\d+(?:-\d+)? · (safe|structural|report-only)\b.* — /m;
+
+export default (output, context) => {
+  const { checkout, context: dir } = context.vars;
+  const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..', '..', '..');
+  const ctx = path.resolve(root, dir);
+  const failures = [];
+  const check = (ok, msg) => {
+    if (!ok) failures.push(msg);
+    return ok;
+  };
+
+  const asked = (context.providerResponse?.metadata?.toolCalls || []).filter((c) => c.name === 'AskUserQuestion');
+  check(asked.length === 0, `a headless skill asked ${asked.length} question(s)`);
+
+  const scopePath = path.join(ctx, 'scope.json');
+  if (check(fs.existsSync(scopePath), 'cr-prepare wrote no scope.json')) {
+    const scope = JSON.parse(fs.readFileSync(scopePath, 'utf8'));
+    const active = scope.lenses.active.map((l) => l.lens);
+    const named = [...active, ...scope.lenses.inactive.map((l) => l.lens)].sort();
+    check(JSON.stringify(named) === JSON.stringify([...LENSES].sort()), `scope.json does not account for all eight lenses once: ${named.join(', ')}`);
+    check(!active.includes('spec'), 'the spec lens is active with no spec named');
+    check(scope.files.map((f) => f.path).sort().join() === 'src/quality-recall.ts,src/security-recall.ts', `judged files are not the committed change: ${scope.files.map((f) => f.path).join(', ')}`);
+    for (const lens of active) {
+      const p = path.join(ctx, `${lens}.md`);
+      check(fs.existsSync(p) && /^Lens: /m.test(fs.readFileSync(p, 'utf8')), `cr-scan left no ${lens}.md with its Lens header`);
+    }
+  }
+
+  const report = path.join(ctx, 'report.md');
+  check(fs.existsSync(report) && /Reconciliation/.test(fs.readFileSync(report, 'utf8')), 'cr-merge wrote no report.md with a Reconciliation line');
+  check(/status: merged/.test(output), 'cr-merge did not return status: merged');
+  check(FINDING.test(output), 'no finding line in the fixed `severity · family · rule · path:L · class — fix` shape');
+  check(/^- high · security · /m.test(output), 'the planted security finding did not come through the merge');
+
+  const dirty = execFileSync('git', ['-C', path.resolve(root, checkout), 'status', '--porcelain'], { encoding: 'utf8' }).trim();
+  check(dirty === '', `the review edited the checkout: ${dirty}`);
+
+  return { pass: failures.length === 0, score: failures.length === 0 ? 1 : 0, reason: failures.join('; ') || 'all checks passed' };
+};

plugins/code-review/evals/promptfooconfig.yaml

@@ -24,6 +24,10 @@ prompts:
   # for the CODING_STANDARDS pair.
   - id: file://prompts/standards.txt
     label: standards-track
+  # Headless track: the three model-only skills a workflow drives, run in sequence against a
+  # committed change in a git sandbox that reset-sandbox.sh rebuilds.
+  - id: file://prompts/headless.txt
+    label: headless-track
 
 providers:
   - id: anthropic:claude-agent-sdk # alias: anthropic:claude-code
@@ -805,3 +809,14 @@ tests:
       - type: regex
         value: '[Ss]kipped'
 
+  - description: 'eval-20 headless-pipeline (cr-prepare → cr-scan × N → cr-merge)'
+    prompts: [headless-track]
+    vars:
+      checkout: plugins/code-review/evals/.sandbox/headless
+      context: plugins/code-review/evals/.sandbox/headless-ctx
+    # Eight lenses in one agent's context: the default cap would abort mid-run. The skills write
+    # their context files; without Write and Bash the agent narrates a review it never ran.
+    options: { max_budget_usd: 12, allow_all_tools: true }
+    assert:
+      - type: javascript
+        value: file://checks/headless-pipeline.mjs

plugins/code-review/evals/prompts/headless.txt

@@ -0,0 +1,10 @@
+Review the last commit of the git checkout {{checkout}} with the code-review plugin's headless
+skills, exactly in this order, through the Skill tool:
+
+1. `code-review:cr-prepare` with `--base HEAD~1 --out {{context}} -C {{checkout}}`.
+2. `code-review:cr-scan` with `--lens <lens> --context {{context}}`, once for every lens its
+   closing block lists as active.
+3. `code-review:cr-merge` with `--context {{context}}`.
+
+Then reply with the three skills' closing blocks, verbatim, in that order — the cr-scan blocks
+one after another — and nothing else.

plugins/code-review/evals/reset-sandbox.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# Rebuild the git checkout the headless-track eval reviews: a base commit, then one commit that adds
+# two fixtures with planted findings. The headless skills review committed changes only, so the
+# file-path fixtures the other tracks read cannot serve them. scripts/run-evals.sh runs this first.
+set -euo pipefail
+cd "$(dirname "$0")"
+
+rm -rf .sandbox
+repo=.sandbox/headless
+mkdir -p "$repo/src"
+git -C "$repo" init -q -b main
+printf '# orders service\n' > "$repo/README.md"
+git -C "$repo" add -A
+git -C "$repo" -c user.name='cr-evals' -c user.email='cr-evals@localhost' commit -q -m 'base' --no-gpg-sign
+
+# Under src/, not fixtures/: scope.md classes anything below a fixtures/ directory as test code.
+cp fixtures/security-recall.ts "$repo/src/security-recall.ts"
+cp fixtures/quality-recall.ts "$repo/src/quality-recall.ts"
+git -C "$repo" add -A
+git -C "$repo" -c user.name='cr-evals' -c user.email='cr-evals@localhost' commit -q -m 'feat: add order lookup and pricing' --no-gpg-sign
+
+echo "code-review sandbox reset: $(pwd)/$repo"