Review Pr

Review PR

You are orchestrating a thorough code review for a Pluto pull request.

Input

The argument is either a PR number (e.g. 311) or a full GitHub PR URL. The repository is always NethermindEth/pluto.

Resolve the PR number if a URL was given:

# From URL like https://github.com/NethermindEth/pluto/pull/311
PR=311

Step 1 — Gather context

Run these in parallel:

gh pr view $PR --repo NethermindEth/pluto \
  --json title,body,files,additions,deletions,headRefName,commits
gh pr diff $PR --repo NethermindEth/pluto

Read every changed file from disk (the branch may already be checked out). If a file is not available locally, use the raw diff.

Also note the head commit SHA — you will need it for the review API call.

If the PR touches DKG, sync, reshare, FetchDefinition, or peer-indexed broadcast code, load .claude/skills/pluto-review/references/trail-of-bits-charon-v2-audit.md and include that audit overlay in the pluto-review and security-review agent prompts.

Step 2 — Parallel agent review

Spawn four agents in a single message so they run concurrently. Give each agent the full diff and relevant file contents in its prompt.

Each agent must return findings as JSON objects:

{
  "file": "crates/foo/src/bar.rs",
  "line": 42,
  "severity": "bug|major|minor|nit",
  "title": "short title",
  "body": "detailed explanation with code snippets if helpful"
}

Step 3 — Deduplicate and assess

Merge the four finding lists. For each finding:

• If the same issue is raised by multiple agents, merge into one finding (use the most detailed body).
• Assign a final severity: bug → major → minor → nit.
• Prefix the comment body with nit: if severity is nit.
• Verify every file path and line number against the actual diff before posting — do not guess.

Step 4 — Post inline comments via GitHub review API

Build a single JSON payload and post it in one API call:

gh api repos/NethermindEth/pluto/pulls/$PR/reviews \
  --method POST \
  --input /tmp/review_payload.json \
  --jq '{id:.id, state:.state, url:.html_url}'

Payload shape:

{
  "commit_id": "<head-sha>",
  "body": "<overall-assessment — see Step 5>",
  "event": "APPROVE | REQUEST_CHANGES | COMMENT",
  "comments": [
    {
      "path": "crates/foo/src/bar.rs",
      "line": 42,
      "side": "RIGHT",
      "body": "comment text"
    }
  ]
}

Rules for comments:

• One comment per finding. Do not batch multiple issues into one comment.
• Use line + side: "RIGHT" for new/modified lines (additions).
• Use side: "LEFT" only for deleted lines.
• If line is unavailable or ambiguous, omit it — the comment lands at the file level, which is still useful.
• nit-level findings must start with nit: in the comment body.

Step 5 — Overall assessment

Write a 3–5 sentence overall body for the review covering:

1. What the PR does and overall quality signal.
2. A numbered list of bugs (must-fix before merge).
3. Summary of major/minor findings.
4. Verdict rationale.

Verdict rules:

Output

After the API call succeeds, print:

Review posted: <html_url>
Verdict: <APPROVE|REQUEST_CHANGES|COMMENT>
Findings: <N bugs, M major, P minor, Q nits>