Require current CodeRabbit review receipts

[samtay32]

Outcome

Make a real CodeRabbit review of the final PR revision independently verifiable and install the same fail-closed guardrail into projects initialized by the package.

Scope

• add the repository's missing root .coderabbit.yaml and keep it synchronized with the installed template;
• add a dependency-free GitHub GraphQL review-receipt evaluator;
• reject missing, stale, rate-limited, change-requested, unresolved, or truncated review evidence;
• install the evaluator and workflow as protected package-managed files;
• update the review-loop skill and documentation.

Decisions and non-goals

• CodeRabbit remains an adversarial reviewer, not merge authority.
• Every fix push invalidates the previous receipt.
• A rate-limit message or green CodeRabbit summary status is not approval.
• This bootstrap PR does not yet enable or require the repository workflow; that happens only after the protected evaluator exists on main.
• This PR does not publish a new npm version.

Verification

• npm run release:check
• 32/32 tests pass
• npm dry-run package contains 58 files
• packed install smoke test passes
• git diff --check

Migration, rollback, and monitoring

Existing installed projects receive protected update proposals through the normal upgrade/reconciliation flow. Rollback is a normal revert before the workflow becomes required. The receipt check reports a precise blocking reason without printing the GitHub token.

Review contract

CodeRabbit must review the final head commit. Production-level findings will be fixed, pushed, and explicitly re-reviewed until no actionable current thread remains.

Summary by CodeRabbit

• New Features

  • Added automated review-receipt validation for pull requests.
  • Added a protected workflow that verifies a current, acceptable CodeRabbit review before merging.
  • New installations include the review safeguards automatically.

• Documentation

  • Updated setup, branch-protection, and review-closure guidance with stricter merge-readiness requirements.

• Tests

  • Added coverage for review validation, workflow installation, and synchronized review policies.

[samtay32]

@coderabbitai review

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 49 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: e43887d0-4d41-4b8d-a475-0cde293e4fe3

📥 Commits

Reviewing files that changed from the base of the PR and between 9e20908 and 9d0238b.

📒 Files selected for processing (3)

• assets/project-template/.github/workflows/review-receipt.yml
• docs/GITHUB_LOOP.md
• test/maintenance.test.mjs

📝 Walkthrough

Walkthrough

Adds a fail-closed CodeRabbit review receipt script, a protected GitHub Actions workflow and template assets, synchronized review configuration, updated review-loop guidance, and tests covering receipt validation and installation.

Changes

Review receipt guardrail

Layer / File(s)	Summary
Review receipt evaluation scripts/review-receipt.mjs	Resolves pull request context, fetches bounded GitHub review evidence, validates current-head CodeRabbit reviews and threads, detects review-limit conditions, and returns pass/fail exit codes.
Protected asset installation bin/ultimate-agent-stack.mjs, assets/project-template/.github/workflows/review-receipt.yml, test/agent-stack.test.mjs, package.json	Installs the receipt script and workflow as protected assets, runs the workflow on pull request review events, and validates the installed manifest and script syntax.
Review policy and workflow guidance .coderabbit.yaml, README.md, docs/GITHUB_LOOP.md, skills/close-review-loop/*	Configures automatic assertive reviews and documents current-head receipt requirements, branch protection, repair-loop behavior, and merge-readiness rules.
Receipt and policy validation test/review-receipt.test.mjs, test/maintenance.test.mjs	Tests accepted and rejected review evidence, stale reviews, unresolved threads, truncation failures, context resolution, and repository/template policy synchronization.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant PullRequest
  participant ReviewWorkflow
  participant ReviewReceipt
  participant GitHubGraphQL
  PullRequest->>ReviewWorkflow: pull request or review event
  ReviewWorkflow->>ReviewReceipt: execute with GITHUB_TOKEN
  ReviewReceipt->>GitHubGraphQL: query current-head review evidence
  GitHubGraphQL-->>ReviewReceipt: reviews, threads, comments, and head OID
  ReviewReceipt-->>ReviewWorkflow: pass or fail check result

Loading

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly captures the main change: requiring current CodeRabbit review receipts.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/coderabbit-review-receipt

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[samtay32]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@assets/project-template/.github/workflows/review-receipt.yml`:
- Around line 3-42: The review gate must never fall back to PR-controlled code.
Update the “Select the review gate” step and the `gate` path so
`review-receipt.mjs` is always sourced from the protected default-branch
checkout, and remove the `bootstrap-gate` checkout or any fallback to it.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 05689b43-f9d5-4b5f-a910-e8c0ecd6f4f8

📥 Commits

Reviewing files that changed from the base of the PR and between 91ccd1f and 9e20908.

📒 Files selected for processing (12)

• .coderabbit.yaml
• README.md
• assets/project-template/.github/workflows/review-receipt.yml
• bin/ultimate-agent-stack.mjs
• docs/GITHUB_LOOP.md
• package.json
• scripts/review-receipt.mjs
• skills/close-review-loop/SKILL.md
• skills/close-review-loop/references/review-closure-policy.md
• test/agent-stack.test.mjs
• test/maintenance.test.mjs
• test/review-receipt.test.mjs

[samtay32]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.