feat(workflows): overhaul PR review workflows around /review

[jamesadevine]

Note

Stacked on #1757 (the gh-aw v0.84.0 upgrade). Targets chore/upgrade-gh-aw-v0.84.0, so this diff shows only the review-workflow changes. Merge #1757 first; this will retarget to main automatically.

Replaces the two near-duplicate Rust reviewers with a five-way /review fan-out modelled on githubnext/gh-aw, and adds a sous-chef loop that keeps open PRs moving.

The problem

rust-pr-reviewer.md (every push) and rust-review-command.md (/rust-review) shared ~95% of their prompt, covered only Rust, ignored the TypeScript workspace entirely, and posted summary comments rather than line comments. Nothing closed the loop back to Copilot when a PR stalled.

What gh-aw actually does

/review there is not one workflow — it is a fan-out dispatched by a generated central router, hitting pr-code-quality-reviewer, test-quality-sentinel and design-decision-gate. Reviewers post inline comments batched into a single review, and dedupe across pushes via a shared pre-fetch of the diff and the existing review comments, cached by head SHA.

The five reviewers

Workflow	Owns	Auto-trigger
review-rust	Rust quality — anyhow context, unwrap on user paths, lossy casts, cross-platform paths, async correctness	ready_for_review + every push
review-typescript	scripts/ado-script/ — unhandled rejections, any leakage, unvalidated external input, secret handling	ready_for_review + every push
review-tests	Test quality beyond coverage — untested behaviour, weakened assertions, implementation-detail tests	ready_for_review
review-compiler-contract	ado-aw domain contracts — front-matter/safe-output schemas, typed IR, bundle + codegen drift, docs sync	ready_for_review
review-security	Diff-scoped security regressions — injection into generated YAML, weakened validation, token scope, allowlist widening	ready_for_review

All five answer /review. Only the two code-quality reviewers re-run per push, which is the main cost control.

review-rust and review-typescript are deliberately language-generic; every ado-aw-specific invariant lives in review-compiler-contract. That keeps the five from duplicating each other's comments, and gives one obvious home for future domain rules.

A CI gap this closes

review-compiler-contract detects ncc bundle drift — a change to scripts/ado-script/src/** without the rebuilt *.js. Those bundles are what actually execute inside customer pipelines, so a source change without a rebuild is a no-op at runtime.

ado-script.yml rebuilds the bundles but never diffs them, so nothing in the repo currently catches this. Its drift guard only covers types.gen.ts and fact-catalog.gen.json.

Anti-spam, since two reviewers run on every push

• draft: false on all five — gh-aw's first-class filter, so pushes to drafts cost nothing.
• supersede-older-reviews — stops repeated pushes stacking stale REQUEST_CHANGES reviews.
• Pre-fetched pr-review-comments.json — each reviewer reads what it already said and skips it.
• Per-PR cancel-in-progress concurrency, already generated by gh-aw, supersedes in-flight runs.
• pr-data-prefetch.yml — an engine-less warmer that populates the pr-prefetch-<sha> cache in ~30-60s, so all five get a cache hit instead of five identical API pulls per push.

submit-pull-request-review pins allowed-events: [COMMENT, REQUEST_CHANGES] in the shared base: the Actions actor cannot approve a PR, so permitting it would only fail at runtime.

PR Sous Chef

Runs every 15 minutes and on /souschef. Per PR it posts one @copilot nudge carrying a hidden marker, listing unresolved review threads and failed checks, then resolves answered threads, dismisses stale bot reviews, refreshes the branch and pushes cargo fmt --all fixes.

Guards against nagging: 30-minute marker cooldown; skip when the latest comment is already ours (overridden when the branch is CONFLICTING, since nobody else will resolve it); skip while checks run, with checks running over an hour treated as stale so long agentic jobs cannot block nudges forever; cap of four nudges per run. A marker comment that does not mention @copilot is informational and counts toward neither rule.

It deliberately does not rebuild the TypeScript bundles — that needs npm ci plus two cargo run invocations, far too costly at 96 runs/day. Bundle drift is reported by review-compiler-contract instead.

Command changes

Before	After
/rust-review	/review
/change-risk	/risk (change-risk.md → risk.md)

/scout, /plan and /risk also move to strategy: centralized, so all commands now route through the generated agentic_commands.yml. This resolves the advisory gh aw validate was emitting.

Router now reads:

/review    -> review-compiler-contract, review-rust, review-security,
              review-tests, review-typescript
/risk      -> risk
/scout     -> scout-command
/plan      -> issue-plan-maker
/souschef  -> pr-sous-chef

Verification

• gh aw compile — 27 workflows, 0 errors.
• gh aw validate — clean; centralized-routing advisory resolved.
• shellcheck — 0 findings across all three added bash bodies.
• No stale /rust-review or /change-risk references outside CHANGELOG.md.
• Recompiled after rebasing onto latest main: byte-identical output, so no drift.

Two gotchas, now documented in AGENTS.md

Both cost a compile cycle and will bite the next person:

1. permissions: cannot be inherited from an import. Every workflow must declare its own, even when importing a shared base.
2. A literal ${{ }} in a markdown body is parsed as an expression and fails compilation with "unauthorized expressions". Describe the syntax in prose instead.

AGENTS.md also gains a "Repository agentic workflows" section documenting all five commands, the fan-out, the shared components and the sous chef.

[azure-pipelines]

Azure Pipelines:
2 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.