Lighten review routing and gate semantics: ordinary review by default, P0/P1-only blocking, scoped re-review

README.md

@@ -224,7 +224,7 @@ The Pi package loads the Superpowers skills and a small extension that injects t
 - **reconciling-issues** - Audit decomposed parent issues against child outcomes before closure
 - **working-from-issues** - Route triaged issues into the right Superpowers workflow
 - **requesting-code-review** - Pre-review checklist
-- **code-review** - Recall-first review gate for PRs, branches, and diffs
+- **code-review** - Recall-first max review for high-risk changes, bug hunts, and explicit deep reviews
 - **receiving-code-review** - Responding to feedback
 - **using-git-worktrees** - Parallel development branches
 - **finishing-a-development-branch** - Merge/PR decision workflow

docs/superpowers/evidence/code-review/2026-07-11-clean-diff-lighten-claude-green.md

@@ -0,0 +1,64 @@
+# Evidence transcript
+
+- Date: 2026-07-11
+- Harness: 2.1.206 (Claude Code)
+- Phase: green
+- Prompt file: /private/tmp/claude-501/-Users-liqiongyu-heyi-superpowers/6c345c79-7e78-4b8d-aea0-6d4df3365d1e/scratchpad/scenario2-clean-diff.txt
+- Workspace: scratch git repository (created by run-skill-evidence.sh)
+- Plugin load: --plugin-dir /Users/liqiongyu/heyi/superpowers (working tree loaded directly; no cache to drift)
+
+## Prompt
+
+````text
+Review the following change. Use the code-review skill if it is available.
+Do not modify any files and do not contact any external service; produce the
+review as text with your findings as a JSON array.
+
+diff --git a/src/greeting.js b/src/greeting.js
+index 82ab114..f10c377 100644
+--- a/src/greeting.js
++++ b/src/greeting.js
+@@ -1,5 +1,5 @@
+-function greet(name) {
+-  return 'Hello, ' + name + '!';
+-}
++function greet(name) {
++  return `Hello, ${name}!`;
++}
+
+ module.exports = { greet };
+````
+
+## Session output
+
+````text
+## Code Review
+
+I reviewed the change to `src/greeting.js`. The diff converts a string-concatenation expression to an equivalent template literal:
+
+```js
+- return 'Hello, ' + name + '!';
++ return `Hello, ${name}!`;
+```
+
+**Analysis:**
+
+- **Behavioral equivalence:** Both forms produce identical output for every input. `+` and template-literal interpolation both perform `ToString` coercion on `name`, so `null`, `undefined`, numbers, objects, etc. all stringify the same way. No behavior change.
+- **Correctness:** No bug introduced. The exported `greet` contract (`module.exports = { greet }`) is unchanged.
+- **Security / injection:** Not applicable — this is a plain string builder with no query, HTML, or shell context.
+- **Style:** The template literal is idiomatic modern JS and is a slight readability improvement.
+
+One thing worth noting: in the diff, the unchanged `function greet(name) {` and `}` lines appear as both removed and added. That usually signals a whitespace or line-ending change (e.g., CRLF↔LF or trailing whitespace) applied to the whole hunk. It's cosmetic and not a defect, but if unintended it could add noise to the diff. This is an observation, not a finding — I can't confirm it from the diff text alone.
+
+No correctness, security, or contract findings survived verification.
+
+**Findings (JSON):**
+
+```json
+[]
+```
+
+No changes were made to any files, and no external services were contacted.
+````
+
+- Exit code: 0

docs/superpowers/evidence/code-review/2026-07-11-gate-p2-after-claude-green.md

@@ -0,0 +1,66 @@
+# Evidence transcript
+
+- Date: 2026-07-11
+- Harness: 2.1.206 (Claude Code)
+- Phase: green
+- Prompt file: /private/tmp/claude-501/-Users-liqiongyu-heyi-superpowers/6c345c79-7e78-4b8d-aea0-6d4df3365d1e/scratchpad/scenario4-gate-p2.txt
+- Workspace: scratch git repository (created by run-skill-evidence.sh)
+- Plugin load: --plugin-dir /Users/liqiongyu/heyi/superpowers (working tree loaded directly; no cache to drift)
+
+## Prompt
+
+````text
+You are finishing a development branch. The merge gate ran the code-review skill on the full branch diff and returned this findings JSON:
+
+[
+  {
+    "priority": "P2",
+    "file": "src/report.js",
+    "line": 42,
+    "category": "performance",
+    "summary": "Report rows are re-serialized inside the export loop",
+    "failure_scenario": "Exporting a 10k-row report serializes each row twice; export time roughly doubles on large reports"
+  }
+]
+
+There are no P0 or P1 findings. Consult the code-review skill's gate semantics and answer: does this branch pass the merge gate right now? Say exactly what you would do next and what you would tell your human partner. Do not modify any files and do not contact any external service.
+````
+
+## Session output
+
+````text
+## Gate decision: no blocking findings, but the branch cannot pass yet — one P2 needs your adjudication
+
+**Per the code-review skill's Gate Semantics:**
+
+- **P0/P1 block finishing.** There are none, so nothing *blocks*.
+- **P2 findings are non-blocking by default, but they require adjudication by you.** The rule is explicit: *"present each one with a recommendation — fix now or track as follow-up — and record their decision next to the finding. Never silently drop a P2; unresolved P2s appear in the finish report."*
+
+So the answer is: **the branch is not blocked, but the gate does not pass silently.** It passes only once this P2 has a recorded decision from you. I can't self-adjudicate it away.
+
+## The P2, with my recommendation
+
+| Field | Value |
+|---|---|
+| Priority | P2 (performance) |
+| Location | `src/report.js:42` |
+| Summary | Report rows are re-serialized inside the export loop |
+| Impact | Exporting a 10k-row report serializes each row twice; export time roughly doubles on large reports |
+
+**My recommendation: fix now.** The failure mode described (redundant serialization hoistable out of a loop) is usually a small, localized change, and it scales linearly with report size — the kind of thing that's cheap now and annoying to chase later under a "why are exports slow" bug report. If large exports aren't on a hot path for this release, tracking it as a follow-up is a defensible alternative — that's your call, not mine.
+
+## What I'd do next
+
+1. **Not modify anything and not merge** — I'm holding at the gate pending your decision, as instructed.
+2. On your word, either:
+   - **Fix now** → apply the change, then re-verify with a review *scoped to the fixed finding and the code the fix touches* (not the full protocol — the fix wave is narrow). Gate passes when that re-verification shows no blocking findings.
+   - **Track as follow-up** → record that decision next to the finding and carry it into the finish report as an unresolved-but-accepted P2.
+
+## What I'd tell you
+
+> The branch has zero P0/P1 findings, so nothing blocks the merge. There's one P2 — a performance issue at `src/report.js:42` where report rows get serialized twice inside the export loop, roughly doubling export time on large (~10k-row) reports. The gate can't clear until you decide: **fix it now** (I'd lean this way — it's likely a small hoist-out-of-the-loop change) **or track it as a follow-up**. Which do you want? Either way it goes in the finish report; I won't drop it.
+
+If it helps you decide, I can read `src/report.js` around line 42 to confirm whether the fix is a one-line hoist or something larger — just say the word.
+````
+
+- Exit code: 0