# Code Review Pre Merge Gate > Use this workflow when a PR or MR is close to merge and needs the shared - Skill: `tomevault-io/code-review-pre-merge-gate` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add tomevault-io/code-review-pre-merge-gate` - Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/code-review-pre-merge-gate/raw - Safety review: pending (external: skill-scanner PASS, skillspector PASS) - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: AI & ML - Author: tomevault-io (https://skillmd.com/u/tomevault-io) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/tomevault-io/code-review-pre-merge-gate --- # Code Review Pre-Merge Gate Use this workflow when a PR or MR is close to merge and needs the shared delivery specialist review gate without handing provider actions to the code-review skill itself. ## Contract Prereqs: - Run inside the target git repository with `git` available on `PATH`. - `review-specialists` is installed from the released nils-cli package and available on `PATH`. - The mandatory and risk lenses run through the managed read-only reviewer subagents dispatched by the shared specialist gate on hosts that spawn subagents without an explicit per-run request (e.g. Claude Code). On hosts that only spawn subagents on explicit request (e.g. Codex), review the lenses inline by default — the expected path, not a waiver — and dispatch only on explicit opt-in; record a waiver only when an intended dispatch genuinely fails. - The PR/MR base branch or merge-base is known. - Local validation and provider check evidence are available or explicitly marked pending by the owning delivery workflow. - Keep this workflow read-only: it does not fix code, post PR/MR comments, mark reviewables ready, merge, close issues, or clean branches. Inputs: - PR/MR identifier or reviewable summary, base ref, head ref, validation evidence, and optional linked issue context. - Optional provider-side review evidence collected read-only by the owning delivery workflow: reviews and review threads already posted on the PR/MR (typically by bot reviewers). When supplied, classify those findings with the same delivery outcome vocabulary as local lens findings. - Optional forced risk lenses beyond the mandatory minimum: `--security`, `--performance`, `--data-migration`, `--api-contract`, or `--red-team`. Outputs: - Scope JSON from `review-specialists scope` with at least `--testing` and `--maintainability` forced. - Gate result: `pass`, `request-followup`, `blocked`, or `accepted-risk`. - Concrete findings, accepted tradeoffs, residual risks, and validation gaps. - A delivery review outcome body suitable for the owning PR/MR delivery workflow to post. Failure modes: - Base ref is missing, ambiguous, or not the PR/MR target base. - Required validation/check evidence is absent and no explicit pending status is acceptable. - Concrete specialist findings remain unresolved and are not explicitly accepted by the owning delivery workflow. - Caller tries to use this workflow to merge, close, post provider comments, or replace `deliver-pr` or `review-dispatch-lane-pr`. ## Entrypoint Run the shared gate's mandatory scope detection: ```bash review-specialists scope \ --base "$BASE_REF" \ --testing \ --maintainability \ --format json ``` Add risk lenses when warranted: ```bash review-specialists scope \ --base "$BASE_REF" \ --testing \ --maintainability \ --security \ --api-contract \ --format json ``` ## Workflow 1. Resolve reviewable metadata and confirm the base ref is the actual PR/MR target branch or merge-base. 2. Follow the shared delivery gate in `skills/code-review/code-review-specialists/references/DELIVERY_SPECIALIST_REVIEW_GATE.md`. 3. Run `review-specialists scope --base "$BASE_REF" --testing --maintainability --format json`. Do not skip small diffs. 4. Add risk lenses for security, API contract, migration, performance, or red-team conditions when the scope warrants them. Include red-team when `diff_lines > 200`, any first-wave specialist produces a `critical` finding, the reviewable changes safety/security-sensitive behavior, or the caller forced `--red-team`. 5. Review the first-wave lenses read-only by dispatching the matching managed reviewer subagents (`reviewer-testing`, `reviewer-maintainability`, and any forced risk lens such as `reviewer-security`, `reviewer-api-contract`, or `reviewer-performance`); collect their JSONL findings, validate and merge them, and classify each item using the shared delivery outcome vocabulary. (On hosts that only spawn subagents on explicit request, such as Codex, review these lenses inline by default.) 6. Dispatch `reviewer-red-team` only after the first-wave lenses, and only when the scope warrants it. On explicit-only hosts such as Codex, run the same red-team lens inline from `references/specialists/red-team.md` unless the user explicitly opted into subagents. Hand it the merged first-wave findings so it can probe cross-cutting failure modes, then validate its JSONL and merge the combined first-wave plus red-team JSONL before folding it into the result. 7. Classify every meaningful first-wave and red-team item using the shared delivery outcome vocabulary. 8. Treat evidence-backed concrete findings as blocking until repaired, accepted by the owner, or converted into an explicit follow-up. 9. Produce a compact gate result and delivery review outcome body. The owning delivery skill posts comments, reruns checks, merges, or stops. ## Boundary `code-review-pre-merge-gate` owns the read-only review gate, reviewer-subagent dispatch when used, inline lens execution on explicit-only hosts, and the review outcome recommendation. Each dispatched reviewer subagent owns only its read-only lens. Provider delivery skills own PR/MR comments, ready transitions, checks, merge/close calls, issue closeout, and repair execution. ## References - Delivery specialist review gate: `skills/code-review/code-review-specialists/references/DELIVERY_SPECIALIST_REVIEW_GATE.md` - Delivery review outcome comment: `skills/code-review/code-review-specialists/references/DELIVERY_REVIEW_OUTCOME_COMMENT.md` - Delivery review outcome schema: `skills/code-review/code-review-specialists/references/DELIVERY_REVIEW_OUTCOME_SCHEMA.md` - PR/MR delivery workflow: `skills/pr/deliver-pr/SKILL.md` - Dispatch PR review workflow: `skills/dispatch/review-dispatch-lane-pr/SKILL.md` --- > Source: [graysurf/agent-runtime-kit](https://github.com/graysurf/agent-runtime-kit) — distributed by [TomeVault](https://tomevault.io).