sdlc-pr-reviewlisted

# Review that scales with output Review capacity was sized for human authorship. One reviewer reads the whole diff, depth varies with how busy they are, the author chases, the queue grows. Once an agent writes most of the diff, reading every line stops being possible — and "review it anyway" quietly becomes skimming with a rubber stamp on the end. The fix isn't less review. It's **uniform passes on every PR, findings ranked by severity, and human attention moved up a level** — to whether this change does what was agreed and whether the risk is acceptable. It runs both directions: the agent reviews incoming changes, and addresses findings on its own. ## What you need A current `CLAUDE.md` (`sdlc-claude-md`) — review reads it, which is what makes the feedback loop below work. Encoded rules where policy is involved. And a committed spec and plan if you want the third pass to mean anything (`sdlc-spec`, `sdlc-plan`). ## The policy file Committed at the repo root, so review depth is a property of the repo rather than of whoever opened the PR. ```markdown # Review policy ## Passes Tag every finding with the pass that produced it. 1. Correctness — logic errors, unhandled edge cases, broken invariants, concurrency and ordering mistakes, error paths that swallow failures. 2. Security — injection, missing authorization, secrets or personal data in logs and error responses, unsafe deserialization. 3. Agreement — does the change do what spec.md described and what pl