feat(review): implement the .lightbridge-code-review.jsonc repo config reader (ADR-0030)

[stephane-segning]

1. Summary

This PR changes:

• Builds .lightbridge-code-review.jsonc (ADR-0030) from scratch as RepoReviewConfig
  (services/agent-runner/src/review/repo_config.rs) — it had zero prior implementation in the
  codebase — and wires every field into the live OpenCode review path:
  • preset/entry_points: carried on the type now (story [Story]: Repo config schema for OpenCode review presets #494's actual ask); resolution against
    entry points lands in story [Story]: Entry points resolve review preset from repo config #495.
  • conventions/architecture/instructions: a new TRUSTED prompt block (prompt.rs), placed
    before the existing untrusted AGENTS.md-style repo_instructions block.
  • focus/ignore: a new DiffFilter (reusing lci-codegraph's proven ignore::gitignore
    pattern) drops a non-matching file's WHOLE diff section in clone.rs::pr_diff — not just its name
    from the file list, which would have left its content reachable through the raw diff text.
  • severity.min: reuses the existing P0/P1/P2 vocabulary the add_review_comment tool
    already emits (not the ADR-0030 sketch's unimplemented info/warning/error scale — avoids a
    second severity vocabulary). Enforced in the tool itself (record.rs): a below-threshold finding
    is never sent to the control plane at all. Threaded across the lci-review-mcp subprocess
    boundary via a new LCI_MCP_MIN_PRIORITY env var, since that tool runs as a separate process from
    the agent-runner supervisor, not an in-process function call.
• New workspace dependency: jsonc-parser (comment + trailing-comma tolerant). The one existing
  hand-rolled JSONC stripper (review-agent/src/opencode/config.rs) is explicitly documented as tuned
  for the trusted, comma-clean checked-in base config — unsafe to reuse on arbitrary untrusted repo
  content.

It solves:

• Story [Story]: Repo config schema for OpenCode review presets #494 (repo config schema for OpenCode review presets), part of epic [Epic]: Repo-configurable OpenCode review presets (retire fast/deep tiers) #491 — this PR is the
  second and final slice, landing the actual repo-config reader on top of the ReviewConfigs
  generalization from refactor(review): generalize ReviewConfigs to named presets, remove fast:bool (ADR-0103) #527.

---

2. Intent

ADR-0103's preset selection needs a place for a repo to declare it, and ADR-0030 already names
.lightbridge-code-review.jsonc as that file — but ADR-0030 itself had never been implemented (only
a comment in instructions.rs referenced the filename). Rather than bolt on a bare preset field to
a schema that doesn't exist, this PR implements ADR-0030's full sketch (conventions/architecture/
focus/ignore/instructions/severity) and wires every field into the pipeline it's meant to affect —
per this repo's "no dormant/parsed-but-unused fields" convention — so the config surface story #495
resolves presets against is real and load-bearing, not aspirational.

---

3. Scope

In Scope

• RepoReviewConfig reader: parse, size-cap, deny_unknown_fields, degrade-to-None-with-a-warning
  on any failure (malformed JSONC, oversized, schema-invalid) — never fails the review.
• Full field wiring: prompt context, diff filtering, severity-gated finding recording.
• Unit tests for every new piece: repo-config parsing (7 tests), render_context_block (3), the
  focus/ignore DiffFilter (2 in repo_config.rs + 3 diff-splitting tests in clone.rs), the
  severity filter (3, proving the below-threshold case never hits the control-plane mock), and the new
  prompt block (1).

Out of Scope (tracked as the rest of epic #491)

• Fork trust model (ADR-0030's base-vs-head split) — explicitly NOT implemented here. A fork PR's
  config is currently read off whatever's checked out (the PR head), same as a same-repo PR. Doing
  this properly needs an is_fork signal on TaskContext, set from the webhook payload — which story
  [Story]: Entry points resolve review preset from repo config #495's DB/webhook restructuring (already adding entry_point) is the natural place to land it.
  repo_config.rs's module doc calls this out explicitly so it isn't silently dropped.
• Entry-point → preset resolution at the webhook/A2A call sites, and the tasks.tier → preset DB
  migration (story [Story]: Entry points resolve review preset from repo config #495).
• The ultra preset definition (story [Story]: ultra preset with frontier-model config #496).

---

4. Verification

I verified this change by:

• Running automated tests
• Checking logs (test output below)

Commands run:

cargo build --workspace --all-targets
cargo test -p agent-runner -p lci-review-agent -p lci-agent-testkit -p lci-review-mcp

Results:

$ cargo build --workspace --all-targets
Finished `dev` profile [unoptimized + debuginfo] target(s) — 0 errors

$ cargo test -p agent-runner -p lci-review-agent -p lci-agent-testkit -p lci-review-mcp
test result: ok. 69 passed; 0 failed   (agent-runner unit tests)
test result: ok. 5 passed; 0 failed    (rig_fidelity)
test result: ok. 0 passed; 1 ignored   (rig_live_probe — needs live gateway)
test result: ok. 2 passed; 0 failed    (sast_tool)
test result: ok. 132 passed; 0 failed  (lci-review-agent unit tests, incl. new severity-filter +
                                         prompt-block tests)
test result: ok. 1 passed; 0 failed    (golden_parity: all 5 frozen scenarios still byte-identical)
test result: ok. 7 passed; 0 failed    (lci-agent-testkit)
test result: ok. 2 passed; 0 failed    (lci-review-mcp real stdio integration test)

---

5. Screenshots / Evidence

Not applicable — backend config/behavior addition, no UI surface.

---

6. Risk Assessment

Risk level:

• Low
• Medium
• High

Potential risks:

• Fork trust gap (see Scope): until story [Story]: Entry points resolve review preset from repo config #495 lands is_fork, a fork PR's
  .lightbridge-code-review.jsonc is read from its own head, meaning a fork PR could in principle
  point its own review at a weaker severity.min or a focus/ignore that hides changed files from
  the reviewer. This is explicitly flagged, not a silent gap — and the blast radius is bounded:
  findings are still diff-validated at write-back (ADR-0022) regardless of focus/ignore, and
  severity.min only suppresses LOW-severity findings from being posted (it cannot suppress a P0/P1
  the reviewer actually finds and tries to record above the threshold).
• The diff-section filter (clone.rs::filter_diff) does light unified-diff header parsing
  (rsplit_once(" b/")) to key a section by its path — an exotic filename literally containing " b/"
  could mis-parse. Same class of fragility already accepted elsewhere in this codebase's diff-text
  heuristics; worst case is a mis-filtered edge-case file, not a crash (falls back to keeping the
  section via Option::is_none_or).

Mitigation:

• Full workspace build + all touched crates' test suites green, including the byte-frozen golden
  parity harness (proves the new optional prompt block doesn't perturb any existing golden trace) and
  a real stdio round-trip test for the lci-review-mcp env-var threading.
• Every degrade-to-None path in the repo-config reader logs a tracing::warn! naming the reason, so
  a misconfigured .lightbridge-code-review.jsonc is diagnosable from the run logs.

---

7. AI Usage Declaration

AI was used for:

• Understanding existing code
• Generating code
• Refactoring
• Generating tests
• Drafting documentation
• Reviewing the diff
• Not used

Human verification:

• I understand every meaningful change in this PR
• I checked generated code manually
• I checked generated tests manually
• I removed unsupported AI assumptions
• I accept responsibility for this PR

AI-drafted (Claude) for @stephane-segning's review — human-verification checkboxes intentionally
left unticked; only the accountable owner can truthfully check them.

---

8. Reviewer Focus

Please focus your review on:

• Correctness
• Architecture
• Security
• Performance
• Tests
• Maintainability
• Product intent
• Edge cases

Source of truth: #494
(epic #491),
ADR-0030,
ADR-0103.

Builds on #527 (merged) which generalized ReviewConfigs to named presets and removed the fast:bool
structural flag. Entry-point resolution + the DB migration (story #495) and the ultra preset (story
#496) are separate follow-on PRs against the same epic.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 21663f0

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[lightbridge-assistant]

🅵 Fast automated pass — SAST + a quick, diff-scoped look (no repo-wide retrieval). For a deeper, repo-aware review, mention @lightbridge-assistant on this PR.

Reviewed all changed files thoroughly:

• Cargo.toml: Added jsonc-parser = { version = "0.33.1", features = ["serde"] }" for ADR-0030 (``.lightbridge-code-review.jsonc``) and ignore` for glob filtering. Added P2 finding for CVE-checking jsonc-parser version.

• services/agent-runner/Cargo.toml: Marked jsonc-parser and ignore as workspace dependencies with correct features. Dependencies are appropriate; no security concerns beyond the TAP.

• services/agent-runner/src/review/mod.rs: Added pub mod repo_config; and passes None to build_messages/tool_registry with explanatory comments (these are retired surface paths on the way out). Result: Mars.

• services/agent-runner/src/review/opencode.rs: Added min_priority: Option<&'a str> to McpEnv and conditionally pushes LCI_MCP_MIN_PRIORITY env var. Correct wiring.

• services/agent-runner/src/run.rs: Reads repo_config from checkout, builds diff_filter (logs warning+continues on glob-compile errors), repo_config_context, and min_priority, then passes them to run_opencode_agent and McpEnv. diff_filter is passed as diff_filter.as_ref() (Option<&DiffFilter>). Result: Mars.

• services/review-agent/src/flows.rs: Added None to tool_registry calls in tests (stub for retired repo-config/severity wire-through). No functional change; note only in tests. Result: Mars.

• services/review-mcp/src/main.rs: Reads LCI_MCP_MIN_PRIORITY env var, passes as Option<String> to Tools::with_sast. No injection or auth concerns (var from supervisor, stored in min_priority which only compares against P0/P1/P2 strings already validated by AddArgs/ToolSpec schema). Result: Mars

---

🤖 AI-generated review — treat it as untrusted, verify before acting; a human owns the final decision (AI governance).

[lightbridge-assistant]

jsonc-parser version check suggested

jsonc-parser = "0.33.1" is used for untrusted content validation; ensure 0.33.1 is not vulnerable (no CVEs currently shown in external search) and consider pinning to a specific resolved commit if working with CVE databases.

Evidence: Line 187 introduces jsonc-parser = { version = "0.33.1", features = ["serde"] }" for .lightbridge-code-review.jsonc` (untrusted repo-authored input) per ADR-0030

Was this useful? React 👍/👎 to give us feedback

[github-actions]

✅ AI Governance check passed

This PR declares AI usage, references a source of truth, and provides verification evidence. Thank you.