Add AI review workflows, aimed at the stale-contradiction class

[kriszyp]

The 2026-09-05 DLC post-mortem measured where escaped defects are actually caught. The finding was that the gap is not lens quality but CI review coverage across repos — most Harper repos outside harper/harper-pro run no automated review at all, so their defects are caught by humans and agents after the fact, or not at all.

repo	claude	gemini
harper	yes	yes
harper-pro	yes	yes
rocksdb-js	present but pinned to July	same
documentation	none	none
central-manager / host-manager / documentation / skills-internal	none	none

What this adds

Standard thin callers of the reusables in HarperFast/ai-review-prompts, pinned to af81872e (main, 2026-09-01) — the same ref harper and harper-pro are on.

• review-layers: universal — the harper/* layers describe core internals and do not apply to prose.
• repo-specific-checks names what the shared layers cannot know: doc-to-doc stale contradiction (the largest uncovered multi-author defect class in the preceding window — 12 findings across 6 PRs), versioned-docs snapshots, historic-redirects.ts, and the fact that npm run lint is a no-op stub (echo 0) so a green lint here is evidence of nothing.
• validate-caller-workflows — the fail-closed check that these callers carry no shadow job (a non-uses: job alongside the reusable call would run with the caller's permissions without the auth gate) and that both refs pin to a 40-char SHA.

For the human reviewer

• Both reviewers stay OPT-IN. CLAUDE_ALWAYS_ON / GEMINI_ALWAYS_ON are repo variables and I deliberately did not set them: turning them on spends money on every future PR, which is your call, not mine. Until then these fire only on the claude-review / gemini-review label. Merging this PR changes nothing on its own — the variable is what makes it live.
• Make validate a required status check on main once merged; it is written to run unconditionally so it can be required without going permanently pending.
• I could not execute these workflows. Validation is: the YAML parses, the required inputs and secrets match what the reusable at that ref declares (checked against its workflow_call block), and the caller shape is copied from harper's maintained callers rather than written fresh.
• The org secrets must resolve for this repo (HARPERFAST_AI_CLIENT_ID, HARPERFAST_AI_APP_PRIVATE_KEY, plus ANTHROPIC_API_KEY / GEMINI_API_KEY). They are org-level, but I have no way to confirm this repo is in their selected-repository list — worth a check before flipping the variable.

🤖 Generated with Claude Code

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.