feat: add SliceCheck pull request verifier

[sparklesdotdev]

Summary

• add a standalone Python Cloudflare Worker for signed pull-request verification
• compare repository plans with PR diffs through the Anthropic Messages API
• post GitHub verdict comments and render concurrent retrospective audits as offline HTML
• add Slice 58 planning, gate evidence, deployment documentation, and focused tests

Test Results

• uv run --extra dev --with-requirements slicecheck/requirements.txt pytest slicecheck/tests -q — 23 passed
• uv run ruff check slicecheck — passed
• uv run mypy slicecheck/src — passed
• uv run bandit -r slicecheck/src -q -ll — passed
• Wrangler 4.128.0 deploy dry-run — passed
• Existing Python suite — 303 passed, 95.64% coverage
• Existing CLI suite — 138 passed
• Relevant-source Gitleaks scan — no leaks
• Full wrapper remains locally blocked by two findings in the pre-existing untracked opencode.json, which is excluded from this PR

Checklist

• ./scripts/quality-gates.sh passes locally
• New tests added or updated
• Docs updated where applicable
• No secrets or credentials committed

---

Created from a Sparkles sandbox.

Sandbox run: c_6gwvs6tz8297
Repository: neomatrix369/tripwire

[github-actions]

code-review-graph review

Overall risk: 0.60 (MEDIUM) — 162 changed function(s)/class(es), 0 affected flow(s), 97 test gap(s)

Risk-scored changes

Risk	Level	Symbol	Location	Tested
0.60	medium	slicecheck/src/github.py::_github_request	slicecheck/src/github.py:79	no
0.60	medium	slicecheck/src/verifier.py::_validated_result	slicecheck/src/verifier.py:167	no
0.60	medium	slicecheck/src/verifier.py::verify_with_claude	slicecheck/src/verifier.py:255	no
0.55	medium	slicecheck/src/worker.py::_valid_signature	slicecheck/src/worker.py:81	no
0.55	medium	slicecheck/src/worker.py::handle_request	slicecheck/src/worker.py:235	no
0.50	medium	slicecheck/tests/test_audit.py::fake_verify	slicecheck/tests/test_audit.py:144	no
0.50	medium	slicecheck/tests/test_verifier.py::test_verify_uses_workers_fetch_in_production	slicecheck/tests/test_verifier.py:123	(test)
0.50	medium	slicecheck/tests/test_verifier.py::test_verify_without_matching_criteria_is_unverified	slicecheck/tests/test_verifier.py:155	(test)
0.50	medium	slicecheck/tests/test_verifier.py::test_verify_rejects_empty_diff	slicecheck/tests/test_verifier.py:164	(test)
0.50	medium	slicecheck/tests/test_worker.py::FakeRequest.__init__	slicecheck/tests/test_worker.py:16	yes

Test gaps

• slicecheck/src/audit.py::_github_headers (slicecheck/src/audit.py:51)
• slicecheck/src/audit.py::_pr_status (slicecheck/src/audit.py:60)
• slicecheck/src/audit.py::_error_result (slicecheck/src/audit.py:69)
• slicecheck/src/audit.py::_audit_pr (slicecheck/src/audit.py:83)
• slicecheck/src/audit.py::run_audit (slicecheck/src/audit.py:150)
• ...and 92 more without direct tests

Token savings: this graph-backed report used ~38,489 fewer tokens (~65%) than reading every changed file in full (estimated, chars/4 approximation).

---

Powered by code-review-graph — local-first analysis; no code leaves the CI runner.