hanamizuki/solopreneur/greenlight

Greenlight

Automated review loop. Three modes:

• PR mode (default, for open PRs on feature branches) — three phases:

`` Phase 1: Internal Review (subagents review in parallel, report-only) Phase 2: Consolidate + Fix (merge reports → fix via /receiving-code-review → commit + push) Phase 3: External Review Loop (Codex/Gemini/CodeRabbit cycle until clean) ``

• Uncommitted mode (auto-detected when on main + uncommitted changes + no PR):

Codex CLI --uncommitted loop only. Fixes in-place, does NOT commit.

• Post-commit mode (explicit /greenlight post-commit <SHA> invocation only,

no auto-detect): Phase 1 subagents + Codex CLI --commit <SHA> + agy in parallel; merge findings; fix as new commits on top (no amend, no new PR). Skips PR-bound bots.

Host support

On Claude Code this skill is fully supported: every mode, every phase.

On Codex it is `degraded` — it runs on exec, TUI, and App with a documented smaller surface:

Limitation reference: docs/spec/2026-08-10-codex-greenlight-port.md. The filtered Codex publication includes this degraded surface. Reviewed-head binding remains a shared Claude/Codex defect, not a Codex parity gate.

Phase 1 is verified on Codex exec only (docs/spec/2026-08-15-codex-greenlight-phase1.md). TUI and App run the same shared body with no surface gate, so Phase 1 is expected to work there and is simply unproven; if it does not, the all-reviewers-unavailable rule already carries those runs to Phase 3. Phase 3 itself is accepted on all three surfaces.

Arguments

Parsing rules:

• post-commit keyword (case-insensitive): forces post-commit mode regardless of repo

state. Remainder is the SHA spec (single SHA, FROM..TO range, or empty to ask). Other args are ignored.

• external keyword (case-insensitive): PR mode only. Remainder is the reviewer spec.
• unattended keyword (case-insensitive): fail-fast, no prompts. Stripped before

reviewer-spec parsing; combinable with any mode.

• size= token (case-insensitive, value s/m/l): advisory size for the

S/M/L profile, used in PR mode. Stripped before reviewer-spec parsing, like unattended; a malformed value is ignored. Not read in post-commit mode (it computes size from the resolved range) or uncommitted mode (unsized).

• select= / gate= tokens (case-insensitive): PR mode only. Stripped before

reviewer-spec parsing on the same line as unattended and size= — a token left in the remainder becomes part of the reviewer spec, so gate=codex-bot would be looked up as a reviewer named gate=codex-bot and miss on every lookup thereafter. Unknown or since-marked ids degrade with a warning inside resolve; they never fail the run.

• No keyword: mode comes from auto-detection (see Step 1 table).

Arguments other than post-commit are ignored in Uncommitted mode and Post-commit mode — those modes have fixed flows.

Verification gate

An optional adversarial verification gate can run between consolidating review findings and dispatching a fix subagent: each consolidated finding is independently challenged by 3 skeptic subagents inside one Claude Code Workflow, and findings a majority of skeptics refute are dropped. Only survivors reach the fix subagent. Purpose: cut false-positive fix cycles — a wrongly "fixed" false positive costs a whole extra review round.

Availability check. The gate runs ONLY when BOTH conditions hold: the effective size is L (see Sizing — S and M skip the gate regardless of tooling), AND the Workflow tool is present in the current session (Claude Code v2.1.154+, paid plans). Before each gate, check both:

• Size L and `Workflow` present → run the gate. The script, VERDICT_SCHEMA,

args contract, verdict rule, and result mapping are defined once in references/adversarial-verify.md.

• Size S or M, or `Workflow` absent → **skip the gate entirely; the flow is

exactly today's flow** — hand every consolidated finding straight to the fix subagent. The gate is never a hard dependency of greenlight.

The gate applies at exactly three points, each carrying a short callout below: PR-mode Phase 2a→2b, Post-commit Phase 1→Phase 2, and Post-commit Phase 3 Step 3→Step 4. It does NOT apply to Uncommitted mode or PR-mode Phase 3 (external review threads carry GitHub resolve/reply obligations and are already evaluated per-thread through receiving-code-review).

Rejected findings still count. Gate-rejected findings count as "items pushed back" in the final report, and their reasoning must be carried into later rounds' "prior push-backs" context so a repeat finding can push-back-exit.

Inner verify loop (objective verifier gate)

Every fix dispatch that ends in a commit is wrapped in an inner verify loop: after the fix subagent edits, it runs an objective verify command against the working tree before committing, and may commit + push only once that command passes. This is a different question from the reviewer-clean stopping criterion — keep the two roles separate:

• Verifier (objective, runs code) — gates whether a fix may push. It

executes the repo's own lint / typecheck / fast-unit command and observes real behavior (import errors, type errors, regressions).

• Reviewer-clean (subjective, reads diffs) — gates whether the outer loop may

stop. Codex / agy read the diff statically; they cannot run code, so they are not verifiers. Do not conflate the two, and never position codex/agy as the verifier.

Applies to the PR-mode Phase 2b, PR-mode Phase 3 (Step 3b), and both Post-commit fix dispatches (Phase 2 initial fix and Step 5). Uncommitted mode is exempt — it never commits, so there is nothing to gate; leave it as-is.

Resolving the verify command

The orchestrator resolves the command once, before the first fix dispatch of the run, and passes it into each fix subagent prompt. Source the config helpers in the same bash block — the marker block from Pre-flight Step 2, copied as-is — then:

# `verify` is stored as { "cmd": "<command>" }; pull the string out. An unset key
# makes read_* print nothing → jq gets empty stdin → 2>/dev/null keeps the block
# alive and VERIFY_CMD ends up empty.
VERIFY_CMD=$(read_solopreneur_config verify | jq -r '.cmd // empty' 2>/dev/null)
[ -z "$VERIFY_CMD" ] && echo "NO_VERIFIER" || echo "VERIFY_CMD=$VERIFY_CMD"

• `VERIFY_CMD` empty (`NO_VERIFIER`) → skip the inner loop entirely; the fix

subagent commits exactly as it does today. Add one flag-style line to the final report: "no objective verifier configured for this loop" (see Flags below). Never invent a command.

• `VERIFY_CMD` set → pass it into every fix subagent this run, together with

the inner-loop instructions below.

Inner loop (inside the fix subagent)

The loop lives INSIDE the fix subagent's instructions — the subagent owns edit → verify → iterate and only commits on a green verify. When VERIFY_CMD is set, add this block to the fix subagent prompt (on top of that path's own commit-message and hard-constraint instructions):

You have an objective verify command: <VERIFY_CMD>. Before you commit:
 
1. Apply your fix edits to the working tree.
2. Run <VERIFY_CMD> against the working tree. Do NOT commit first — lint /
   typecheck / fast-unit are working-tree operations, so verify-before-commit
   holds in EVERY mode, post-commit included (no "broken commit + fix commit"
   sequence is ever created).
3. Pass (exit 0) → proceed to the commit + push step already specified for this
   path (unchanged commit message).
4. Fail (non-zero) → do NOT commit. Feed yourself back only a TRUNCATED log — the
   final failing assertion / first error line plus the tail, capped in size the
   same way this file caps agy input at AGY_MAX_DIFF_BYTES — and retry the fix.
5. Cap: 3 verify attempts total. On the 3rd consecutive failure, do NOT commit or
   push — return a structured halt result (reason `inner-verify-failed`,
   `reason_class: invariant-violation`, the FULL verify log, your attempted-fix
   summary) instead of committing.
 
Truncate every feedback log this way; the full log rides only in the halt
payload. Three stacked rounds of full logs would otherwise drown the signal.

Anti-gaming guard (before every commit)