Bug: cmd_pr_lifecycle fast-path merges PRs with zero reviews — review-bot-gate never integrated

[robstiles]

Description

The supervisor's cmd_pr_lifecycle function in deploy.sh has a fast-path that merges PRs when CI is green and zero review threads exist. It does NOT check whether any review (human or bot) has actually been posted. This resulted in 25 PRs being auto-merged to main with zero reviews, zero inline comments, and no human approval.

Root Cause

Primary bug — deploy.sh:350-356 (fast-path):

if [[ "$thread_count_fastpath" -eq 0 ]]; then
    log_info "Fast-path: CI green + zero review threads - skipping review_triage"
    cmd_transition "$task_id" "merging"  # <-- merges with no review check
fi

The fast-path checks for absence of objection (zero unresolved threads) but never checks for presence of approval (at least one review exists). A PR that no one has ever reviewed has zero threads and triggers the fast-path to merge.

Secondary bug — review-bot-gate-helper.sh exists with check, wait, and list commands but is NEVER called from any supervisor module. Zero references in deploy.sh, pulse.sh, or ai-lifecycle.sh. The script was built (per t1382) but never wired into the merge path.

Contrast with AI lifecycle — ai-lifecycle.sh:369-385 correctly gates on reviewDecision=APPROVED:

if [[ "$auto_merge_enabled" != "true" ]]; then
    if [[ "$current_review_decision" != "APPROVED" ]]; then
        log_info "merge blocked — human review required"
        return 0
    fi
fi

But the cmd_pr_lifecycle fast-path runs FIRST and merges before the AI lifecycle sees the PR.

Impact

25 PRs merged to a private repo's main branch with:

• 0 human reviews
• 0 bot reviews (CodeRabbit, Gemini Code Assist)
• 0 inline comments
• No /pr review run

These PRs included: race condition fixes, billing logic changes, security hardening (prompt injection defense), and concurrency guards. All high-risk changes that warranted review.

Expected Behavior

Before merging, cmd_pr_lifecycle should verify at least ONE of:

1. reviewDecision == APPROVED (human approved)
2. review-bot-gate-helper.sh check returns PASS (bot has posted)
3. At least one review exists (even if not approved)

Zero reviews should mean "not yet reviewed" — not "clean to merge".

Suggested Fix

In deploy.sh:344-356, before the fast-path merge decision:

# Check that at least one review exists
local review_count
review_count=$(gh pr view "$pr_number_fastpath" --repo "$repo_slug_fastpath" \
    --json reviews --jq '.reviews | length' 2>/dev/null || echo "0")

if [[ "$review_count" -eq 0 ]]; then
    log_info "No reviews posted yet — waiting for review before merge"
    return 0  # Stay in pr_review state
fi

Or integrate review-bot-gate-helper.sh:

local gate_result
gate_result=$(~/.aidevops/agents/scripts/review-bot-gate-helper.sh check "$pr_number_fastpath" "$repo_slug_fastpath")
if [[ "$gate_result" == "WAITING" ]]; then
    log_info "Review bots haven't posted yet — waiting"
    return 0
fi

Additional Notes

• Repo is on free GitHub (private) so branch protection rules are unavailable as a backup gate
• The AGENTS.md documents "Before merging: run review-bot-gate-helper.sh check" but this is a prompt-level instruction, not enforced in code
• The --skip-review-triage flag and SUPERVISOR_SKIP_REVIEW_TRIAGE env var bypass what little review checking exists

Environment

• aidevops version: 2.149.1
• AI Assistant: OpenCode
• OS: Ubuntu 24.04.4 LTS
• Observed during: /runners batch dispatch session (2026-03-04)
• PRs affected: robstiles/qs-agency feat: add Clawdbot integration for mobile AI access #118, feat(plan+): add granular bash permissions for file discovery #123, fix(coderabbit): update CLI commands to match official docs #124, refactor: elevate mcp_glob warning to MANDATORY section #125, feat: add README create/update workflow and /readme command #129, fix: consolidate version validation to single source of truth #133, feat: add anime.js skill imported via Context7 #137, docs: add Imported Skills section to README #143, docs: address code review feedback on Imported Skills section #144, docs: add cross-reference from cloudflare.md to cloudflare-platform.md #147, docs: add feature branch scenario guidance to pre-edit workflow #148, feat: add Higgsfield AI API support with Context7 documentation #149, feat: add Playwright MCP auto-setup to setup.sh #150, feat: add MiniSim iOS/Android emulator launcher support #151, feat(agents): add technology stack subagents for modern web development #152, docs(playwriter): fix OpenCode MCP configuration #153, feat: add aidevops skill CLI command with telemetry disabled #154, fix: correct ultimate-multisite plugin URL in wp-preferred.md #155, feat: add video-prompt-design subagent for Veo 3 meta prompt framework #156, feat: add content summaries to subagent routing table #157, feat: multi-agent orchestration & token efficiency (p013/t068) #158, feat: add session-time-helper and risk field to task format #159, feat: aidevops update now checks planning template versions #160, feat: add Video main agent for AI video generation and prompt engineering #161, docs: update browser automation section with all tools in tested preference order #162

[alex-solovyev]

PR #2842 has CHANGES_REQUESTED from CodeRabbit. Two major issues identified:

1. WAITING from review-bot-gate-helper.sh incorrectly treated as zero reviews — can stall human-reviewed PRs
2. 2>/dev/null suppressing errors in deploy.sh fast-path gate

Dispatching a worker to address the review feedback.

[alex-solovyev]

Resolved by #2842 (merged). The cmd_pr_lifecycle fast-path now integrates the review-bot-gate check before merging PRs with zero reviews.

[github-actions]

Completed via PR #2842. Task t2839 merged to main.