feat(review): the local review leaves its findings for an agent and reviews again what changed

[soydiloreto]

📝 What changes

scripts/local-review.sh now leaves its findings where an agent can act on them, and reviews again the way the pull request review does:

• The verdict goes to .git/dx-review/ (never committed): findings.md, a list to fix with the file and line of each finding, and last.json.
• The next run on the same branch is incremental: the brief carries the earlier findings and only what changed since, and the review says which are fixed. With nothing new since (same commit, title, description, model, profile and base, hashed with git hash-object, which macOS has), it answers from the file without spending a review; a new title or description is reviewed again; --full reviews everything again.
• It says "Not ready" on everything that would stop the pull request on GitHub: a broken convention, a blocker or a major, a description the review says does not match the code, and a title of another type than the change (on GitHub the review would retitle the pull request after the fact; the title becomes the commit on main and decides the version).
• --model <id> picks the reviewer's model for one run instead of the policy's (a second opinion from a stronger or newer model).

The self-test covers the verdict path with a fake reviewer (LOCAL_REVIEW_CLAUDE), so it spends nothing: a clean verdict, a major, a title of the wrong type, a description that does not match, a second run with nothing new, a retitle on the same commit, an incremental run and the earlier findings reaching its brief, --full, --model. AGENTS.md tells an agent to fix what findings.md lists and run it again until it is ready; CONTRIBUTING.md and the README say the same.

A new job, Scripts on macOS, runs the self-tests of the four scripts a contributor runs (conventions, review-brief, local-review, policy) on macos-latest with the stock bash 3.2 and BSD tools, so what only works with GNU tools fails in CI instead of on a contributor's laptop. CONTRIBUTING.md lists what the local review needs (git, bash, jq, python3 with yq or PyYAML, the Claude Code CLI) and how to get it on macOS.

Separately, compiled translations (languages/*.mo) are no longer low-risk eligible: the brief leaves binaries out, so a pull request that changed only them could merge on its own with nobody, reviewer or person, having seen the change. .po and .pot, which are text, stay low risk. policy.py --test covers both.

💡 Why

The local review printed its findings and forgot them: an agent had nothing to work from, and every run reviewed the whole branch again. Development here is meant to happen locally, with the same checks and the same review as the pull request, and to reach GitHub only when it is clean; the agent doing the work needs the findings as a list it can fix and check off.

🧪 How I tested it

• Every script's --test: conventions, review-brief, local-review (26 cases), policy (25), release-markers, release-ready, stamp-version, next-version.
• actionlint.
• The contributor's scripts' self-tests under bash 3.2 with busybox tools (the bash:3.2 image), all green.
• This branch through local-review.sh itself, with --model claude-fable-5-1. The first run found that a retitle on the same commit returned the old verdict (major) and four minor points; all fixed here, and the second, incremental run checked them. The review on GitHub then found that sha256sum is not on macOS and that the cache ignored the model: fixed, with a test, and the macOS job added so that class of bug is caught in CI.

🤖 AI-generated · Claude Opus 5.5 (Anthropic)

[dilux-bot]

Claude review · risk high · complexity high · type feat

Incremental review, 90a05c7..9984338. The new commits fix both earlier findings. The cache key is now git hash-object --stdin over the title, description, model, profile and base, so sha256sum is gone and nothing needs GNU coreutils. --model, --profile and --base on a commit already reviewed now start a new review. Each of the three new self-test cases fails without the fix, because the cached path prints "Already reviewed" and exits before the brief line or the review line the tests look for. The new scripts-macos job runs the four contributor scripts' self-tests on macos-latest. It puts the stock /bin/bash first on PATH, pins checkout to a commit, and inherits the workflow's contents: read. CONTRIBUTING.md now lists what the local review needs and describes the cache key correctly. Two things I could not verify from the diff. First, policy.py --test on macOS needs yq or PyYAML preinstalled on the runner image; the job will fail visibly if it is missing. Second, the new job only gates merges once someone adds it as a required status check in the organisation settings. The description matches the diff: the local-review state and incremental runs, the not-ready conditions, --model, the macOS job and the .mo policy change are all described. This is a feat because it adds behaviour to the local review tool, not a new product capability, so I don't suggest version:major.

No findings.

_{Policy floor: high (touches high-risk paths: .github/workflows/pull-request.yml, AGENTS.md, CONTRIBUTING.md, README.md, policy/review-policy.default.yml …). Reviewed 9984338 (since 90a05c7; review 2 of 5 automatic). Author trusted for auto-merge: true.}

_{🤖 AI review · claude-opus-5-5 (Anthropic) · $0.30, 7 turns}