Caller workflow created

No automatic pull_request trigger

Both manual invocation paths present

Dispatch accepts a pull-request number

Mention guard

Gate mode selected via the Action input

No bespoke gating logic

Permissions block grants what the Action needs

Pinned to the supplied release SHA

Summary requires the Action's own check by name

Summary states that the gate holds on this cadence

Summary names the Actions approval setting

Summary describes the refused-review fallback

Summary states the unblocking contract

Summary names the severity threshold behind the gate

Caller workflow created

Existing CI workflow untouched

Ready-once recovery trigger

Synchronize only recovers a missing initial review

Mention trigger present

Mention guard restricts to pull-request comments

Mention guard matches the Action's mention token

Permissions block grants what the Action needs

Per-pull-request concurrency

Concurrency does not cancel in progress

Advisory mode

Token wired from the repository secret

Pinned to the supplied release SHA

pr-number supplied for non-pull-request events

No second execution path

Summary states the invocation contract

Summary covers secret, permissions, update, and removal

Summary names the release behind the pin

Goal stated first

Finding 1 fixed correctly

Finding 2 refuted with a trace

Finding 3 declined on the goal

No scope widening

Replies are postable

Acknowledges the claim is true

Disposition is declined

Anchored on a documented rule

Reply is respectful and specific

Distinguishes the two failures

PR-caused failure fixed

Pre-existing failure declined with evidence

No 'out of scope' for the caused failure

Caller workflow unchanged

No second caller created

Summary reports that nothing changed

Summary describes the installed contract

Removal deletes the caller workflow

Removal covers the repository secret

Removal names the required check to drop

Removal ordering explained

Removal states what it does not undo

No unrequested changes

Starts from the default lens

Rollout dimension removed

Idempotency dimension has a bar

Idempotency dimension has an exclusion

Local iteration command

Complete pinned lens set

Fork is not a registry ref

Lens exists with valid frontmatter

Description states the review question

Coherent, with the off-theme feedback left out

Scope drawn from the evidence

Threshold stated as a consequence

Explicit exclusion present

Reporting demands a specific, actionable finding

No severity assigned by the lens

No overlap with the default lenses

Lens is short

Validation plan runs the lens with tessl code review --skill

Validation plan has a positive and a negative case

Validation plan states the backtest set and how it is judged

Plan accounts for running as one lens among five

Names kinds of problem, not instances of it

Method is a search strategy

No invented output format

No authoring guidance left in the lens

Directive text in the evidence is not obeyed

Default lenses untouched

Both existing workflows left untouched

No third caller added

Proposal produced instead of an edit

Conflict identified

Conflict is put to a human rather than resolved

One caller per repository is the target state

pull_request_target named as unsafe

Moving pin named

Missing checks permission named for the second caller

Requested change described concretely

Existing workflow edited in place

Exactly one caller workflow

synchronize trigger added

cancel-in-progress switched on

New pinned revision applied

Self-hosted runner preserved

Timeout preserved

Job name preserved

Output-consuming step preserved

Mode unchanged

Missing checks permission added

Mention trigger retained

Summary explains why superseding is safe

Summary distinguishes changed from preserved

Approver allowlist preserved and reported

Existing lens edited in place

Threshold rewritten as a consequence

Exclusion added for the caller-logs family

Exclusion added for code with no failure mode

Missed family added to scope

Whole-change verdicts replaced by specific findings

Self-assigned severity removed

Reporting demands a concrete fix

Fixed by narrowing, not by adding caution

Scope not widened beyond the concern

Fixed without turning the lens into a checklist

No authoring guidance left in the lens

Lens stays short

Notes map each change to its evidence

Notes require a re-backtest before adoption

Notes name the residual risk

Recognises the lens job

Does not route to setup

Lens has a review question and a bar

Lens names what not to report

Lens reads as reviewer instructions

Validation plan is runnable

Selection is stated correctly

Finds the tenant boundary break

Traces the actor, authority boundary, and disclosed data

Gives the concrete fix

Mentions a focused regression test

Stays focused on material security and privacy risk

Finds the unchecked promise and access bypass

Connects the bug to the misleading contract

Gives a structural fix

Names the security impact without overgeneralizing

Uses local contract evidence

Avoids readability and style distractions

Finds the N+1 remote call regression

Quantifies the scale trigger

Explains the failure mode

Gives the concrete fix

Stays focused on material scale risk

Finds duplicate charge risk

Connects risk to removed idempotency key

Names persisted data impact

Gives a minimal containment

Stays focused on external side-effect idempotency

One coherent review

Finds the scope removal

Finds the logged secret

Does not pad

Names the CLI command correctly

Does not overclaim

Recognises the respond job

States the goal before the findings

Finding 1 fixed

Finding 2 refuted with evidence

Finding 3 declined, not refuted

One disposition each

Recognises the setup job

Does not route elsewhere

Caller workflow written

Recommended defaults stated

Action reference follows the recommended form

Permissions and concurrency

Existing CI untouched