Set review depth for agent PRs by risk tier and merge low-risk ones unread

Kondo builds karasu, an architecture modelling language, with every line written by Claude Code. He set up four review tiers chosen by which paths a PR touches. High covers CI, lockfiles and the review machinery: CodeRabbit reviews until no critical or major findings remain and he reads the diff. Design covers design documents: one CodeRabbit pass plus his read. Medium skips CodeRabbit and he decides from the agent's local review record. Low covers new ADRs or test-only changes and merges unread if the record and CI pass. The record is a table in the PR body of who reviewed and what was fixed or declined, and a required check ties it to the latest commit. He also replaced an earlier hook that parsed shell commands with a gh wrapper placed first on the session's PATH, which refuses to mark a PR ready before the local review.

Of 76 PRs closed in the week, 70 merged. Among 50 with a tier label, 18 were High, 10 Design, 12 Medium and 10 Low. All 10 Low PRs merged without him reading the diff, 9 of them within 3 minutes of leaving draft, and 22 Medium and Low PRs skipped CodeRabbit. He found 4 High PRs CodeRabbit never reviewed and has not yet checked why. The first monthly release train shipped on its own to npm and the VS Code Marketplace.

The command-parsing hook kept getting bypassed: across 20 CodeRabbit reviews it found gh hidden behind heredocs, env, timeout, eval and xargs, which is why it became a wrapper that sees the real arguments. He has no data yet on whether bugs turn up later in PRs merged unread, and High was inflated this week because much of the work touched the review machinery.