[gabe4coding]

Intent

The repo has no rules that tell which PRs need a human review. This PR adds RISK.md: R0 = Gabe reviews all of it, R2 = no human read, anything else = R1. A CI test now checks its globs, and the CI risk tier rates an edit to RISK.md as T2-hard.
Not in scope: no change to the plugin (hooks/, runtime/, hints/), and no other change to the CI tier rules.

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[A PR changes files] --> B{"A file matches an R0 glob?"}
  B -->|yes| C[R0: Gabe reviews all of it]
  B -->|no| D{"Every file matches an R2 glob?"}
  D -->|yes| E[R2: merges without a human read]
  D -->|no| F[R1: normal review]
  G[A PR changes RISK.md] --> H{"Globs match real files, no R0 and R2 overlap, no R0 file rated docs?"}
  H -->|no| I[CI test fails]

Loading

Risk

R0 (review all of it): this PR sets which future PRs merge with no human read.

ℹ️ 3 items need you: 2 critical, 1 validation gap. Open to see them.

Needs you

#	Needs you	Why	Where
1	Critical: the R2 globs, the files that merge unreviewed	Sets merging without a review, which is like an authorization rule	RISK.md:3
2	Critical: RISK.md added to the hard list of the CI rules	Changes the CI risk rules, which the base marks "nothing lowers it"	.github/risk.yml:22

Validation gaps

Validation gap	Why the checks miss it	Fix for next time	Where
A glob matches the same files for the review level	The test uses risk_tier.matches, not the matcher that sets the level	CI test with fixed sample paths and their expected R0, R1 or R2	.github/scripts/test_risk_md.py:33

Drift	Decisions	Reach	Rollout	Evidence	Reading map
⚠️ CI fixes added on request	4	⚠️ CI risk tier of RISK.md edits	✅ revert undoes all	✅ 4/4 diagram paths proven	4 files, 2 to read first

Drift

Asked: the risk-init rules in RISK.md; then the PR comment "FIX: the validation gaps in this PR".

Warning

Scope grew after the first commit: CI rule and test changes, on your PR comment. No user of the plugin sees it.

+ .github/risk.yml: RISK.md in hard (gap 1 of the first Risk block)
+ .github/scripts/test_risk_md.py: CI check of the RISK.md globs (gap 2)
+ RISK.md: R0, R1 and R2 defined (Greptile P2)

Decisions

Decision	Other option	Chosen because	Rollback
R0 covers all of hooks/**	Only paths.ts and functions.ts	Your choice: approval code sits in register.tsx	easy: edit the glob
docs/permissions.mdx, SECURITY.md not R2	All docs R2	Allow rules and the report path can widen access	easy: edit the glob
Test also fails when an R0 file is docs in risk.yml	Only RISK.md in hard	Stops the same gap for the next .md R0 file	easy: delete the test
No test of the review tool's own matcher	Sample paths test	That matcher is outside this repo; both build the same regex today	—

Reach

What changed	Who else sees it	How you know
CI tier of a PR that edits RISK.md	⚠️ found: the risk workflow labels it T2-hard, not T0	test_hard_paths[RISK.md]
New test in .github/scripts	✅ checked, nothing found: only the risk (classifier tests) job runs it	.github/workflows/risk.yml

Rollout and rollback

• Deploy: ✅ checked, nothing found: the risk workflow reads risk.yml from the base, so the T2-hard rule acts after merge.
• State: Not applicable: no data, no setting, no user default changes.
• Stop: ✅ checked, nothing found: a revert undoes all of it.

Evidence

Claim	Proof	Result
"A file matches an R0 glob?" → yes: each R0 glob matches a real file	test_each_glob_matches_a_file, 15 R0 cases	✅ 15/15
"Every file matches an R2 glob?" → yes: each R2 glob matches a real file	The same test, 15 R2 cases	✅ 15/15
"Every file matches an R2 glob?" → no: no file has two levels	test_no_file_is_r0_and_r2	✅ 0 files in both
"Globs match real files…?" → no: the test fails	4 broken copies of the rules, below	✅ 4/4 fail
An edit to RISK.md is T2-hard	test_hard_paths[RISK.md]; without the entry it was T0	✅
Repo checks pass	pytest .github/scripts, docs, code and format checks	✅ 149 passed, 1 skipped

What	Before	After
CI tier of an edit to RISK.md	'T0' == 'T2-hard' fails	T2-hard

ℹ️ Each broken copy of the rules fails with a clear message.

== R2 glob "nope/**" added
E       AssertionError: R2 glob nope/** matches no file
== "hooks/hooks.json" added to R2
E       AssertionError: in R0 and R2: ['hooks/hooks.json']
== RISK.md removed from hard in risk.yml
E       AssertionError: assert 'T0' == 'T2-hard'          (test_hard_paths[RISK.md])
E       AssertionError: R0 in RISK.md, docs in .github/risk.yml: ['RISK.md']
== "docs/permissions.mdx" added to R0
E       AssertionError: R0 in RISK.md, docs in .github/risk.yml: ['docs/permissions.mdx']
== the real rules
149 passed, 1 skipped

Reading map

ℹ️ 4 files, 2 to read first. Open to choose what to read.

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  f1["1 · RISK.md<br/>config"] -. tested by .-> f2["2 · test_risk_md.py<br/>tests changed"]
  f3["3 · risk.yml<br/>config, CI"] -. tested by .-> f2
  f3 -. tested by .-> f4["4 · test_risk_tier.py<br/>tests changed"]

Loading

#	File	Kind of change	Lines
1	RISK.md	config	1-70
2	.github/scripts/test_risk_md.py	tests changed	1-47
3	.github/risk.yml	config, CI	21-22
4	.github/scripts/test_risk_tier.py	tests changed	181

🤖 Generated with Claude Code

https://claude.ai/code/session_01DXBtFjhb67KkF9iJ7ABaJx

[gabe4coding]

@claude FIX: the validation gaps in this PR

[greptile-apps]

Confidence Score: 4/5

[Medium impact] The policy affects how future pull requests in this repository are reviewed.

The PR appears safe to merge, with a non-blocking documentation gap in how reviewers apply the new policy.

Findings

1.  Review levels lack definitions ▶

Fix with agent prompt

### Issue 1
RISK.md:2-4
`RISK.md` lists `R0` and `R2` paths but never defines the review required for either level, the `R1` fallback, or how to classify a PR that touches several levels. Those rules appear only in the PR description. Add them here so future reviewers can apply the policy without finding this PR.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

Adds RISK.md with review-risk path lists and explanations.

• RISK.md sorts future pull requests into three review levels.

Acknowledged decisions from gabe4coding: existing workflow drift and missing glob checks are deferred; broad hook coverage, safe bench coverage, and the README marketplace risk are intentional.

_{Reviews (1) · Last reviewed commit: "Add RISK.md: the review risk rules for P..." · Reviewed by Greptile}

[gabe4coding]

Fixed both gaps in 09764ca:

• .github/risk.yml: RISK.md is in hard. Before, an edit to it was T0 (docs).
• .github/scripts/test_risk_md.py: fails on a glob that matches no file, a file in both R0 and R2, or an R0 file that risk.yml rates as docs.

The new Risk block names one more gap: the test uses the repo's matcher, not the review tool's. Both build the same regex today. A shared test is not possible here, because the review tool's matcher is not in this repo.

---

Generated by Claude Code