chore(agents): add code-review kit for Silo/Prairie repos

.agents/code-review-kit/README.md

@@ -0,0 +1,86 @@
+# Code-review kit (Silo / Prairie)
+
+Portable Cursor **skill**, **subagent**, and **Bugbot** files for every Silo
+ecosystem repository. Live copies for this Android checkout also sit at the
+repo root (`.cursor/`, `.agents/skills/code-review/`, `.claude/…`).
+
+## Layout
+
+```text
+shared/REVIEW_PROTOCOL.md          # severity + report format
+scripts/apply-code-review-kit.sh   # copy a template into a repo checkout
+templates/
+  android/           # Silo-Server/silo-android
+  apple/             # silo-apple
+  server/            # silo-server
+  plugin/            # first-party metadata/markers/autoscan/watchprovider plugins
+  plugin-sdk/        # silo-plugin-sdk
+  plugins-catalog/   # silo-plugins
+  push-relay/        # silo-push-relay
+  themes/            # silo-themes
+  website/           # siloserver.org
+  unraid/            # unraid-templates
+  roku/              # Prairie-Server/prairie-roku
+  smarttv/           # prairie-smarttv
+```
+
+Each template installs:
+
+| Path | Purpose |
+| --- | --- |
+| `.cursor/agents/code-reviewer.md` | Readonly review subagent |
+| `.claude/agents/code-reviewer.md` | Claude-compat copy |
+| `.agents/skills/code-review/SKILL.md` | In-session / slash skill |
+| `.claude/skills/code-review/SKILL.md` | Claude-compat copy |
+| `.agents/skills/code-review/agents/openai.yaml` | Codex sidecar labels |
+| `.cursor/BUGBOT.md` | Bugbot / Agent Review project rules |
+
+## Apply to another checkout
+
+```bash
+.agents/code-review-kit/scripts/apply-code-review-kit.sh server /path/to/silo-server
+.agents/code-review-kit/scripts/apply-code-review-kit.sh plugin /path/to/silo-plugin-metadata-tmdb
+```
+
+`prairie-android` already uses the Prairie-branded live files at the repo root;
+use the `android` template for upstream `silo-android` (Silo package IDs /
+exposure rules).
+
+### Gitignore note (Android / Apple)
+
+Several client repos ignore `.cursor/` and most of `.claude/*`. After applying
+`android` or `apple`, ensure these exceptions exist (as in this repo’s
+`.gitignore`) so agents and Bugbot rules are actually tracked:
+
+```gitignore
+.claude/*
+!.claude/skills/
+!.claude/agents/
+!.claude/agents/**
+.codex/
+.cursor/*
+!.cursor/agents/
+!.cursor/agents/**
+!.cursor/BUGBOT.md
+```
+
+## Mapping
+
+| Template | Repositories |
+| --- | --- |
+| `android` | `Silo-Server/silo-android` |
+| `apple` | `Silo-Server/silo-apple` |
+| `server` | `Silo-Server/silo-server` |
+| `plugin` | `silo-plugin-metadata-*`, `silo-plugin-markers-theintrodb`, `silo-plugin-autoscan-arr`, `silo-plugin-watchprovider-floppy` |
+| `plugin-sdk` | `silo-plugin-sdk` |
+| `plugins-catalog` | `silo-plugins` |
+| `push-relay` | `silo-push-relay` |
+| `themes` | `silo-themes` |
+| `website` | `siloserver.org` |
+| `unraid` | `unraid-templates` |
+| `roku` | `Prairie-Server/prairie-roku` |
+| `smarttv` | `Prairie-Server/prairie-smarttv` |
+
+Prairie forks that keep Prairie branding should adapt the Android/Apple/Server
+templates’ package IDs and product-exposure notes (see this repo’s root
+`.cursor/BUGBOT.md` for the Prairie Android variant).

.agents/code-review-kit/scripts/apply-code-review-kit.sh

@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+# Apply a code-review kit template into a target repository checkout.
+set -euo pipefail
+
+usage() {
+  cat <<'EOF'
+Usage: apply-code-review-kit.sh <template> <target-repo-root>
+
+Templates (under .agents/code-review-kit/templates/):
+  android | apple | server | plugin | plugin-sdk | plugins-catalog
+  push-relay | themes | website | unraid | roku | smarttv
+
+Also copies shared/REVIEW_PROTOCOL.md into the target at
+.agents/code-review-kit/shared/REVIEW_PROTOCOL.md when missing.
+
+Example:
+  .agents/code-review-kit/scripts/apply-code-review-kit.sh android /path/to/silo-android
+EOF
+}
+
+if [[ $# -ne 2 ]]; then
+  usage
+  exit 2
+fi
+
+TEMPLATE="$1"
+TARGET="$2"
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+KIT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+SRC="$KIT_ROOT/templates/$TEMPLATE"
+
+if [[ ! -d "$SRC" ]]; then
+  echo "Unknown template: $TEMPLATE" >&2
+  usage >&2
+  exit 1
+fi
+
+if [[ ! -d "$TARGET/.git" && ! -f "$TARGET/.git" ]]; then
+  echo "Target does not look like a git checkout: $TARGET" >&2
+  exit 1
+fi
+
+mkdir -p "$TARGET/.agents/code-review-kit/shared"
+cp "$KIT_ROOT/shared/REVIEW_PROTOCOL.md" \
+  "$TARGET/.agents/code-review-kit/shared/REVIEW_PROTOCOL.md"
+
+# Copy template tree (agents, skills, BUGBOT).
+while IFS= read -r -d '' file; do
+  rel="${file#"$SRC"/}"
+  dest="$TARGET/$rel"
+  mkdir -p "$(dirname "$dest")"
+  cp "$file" "$dest"
+  echo "wrote $rel"
+done < <(find "$SRC" -type f -print0)
+
+echo "Applied '$TEMPLATE' code-review kit to $TARGET"

.agents/code-review-kit/shared/REVIEW_PROTOCOL.md

@@ -0,0 +1,60 @@
+# Silo / Prairie code-review protocol
+
+Shared process for in-session code-review skills and `code-reviewer` subagents.
+Repo-specific checklists live beside each template; do not skip this protocol.
+
+## When to run
+
+- After implementing a feature or fix, before opening or updating a PR
+- When the user asks for a code review, Bugbot-style review, or adversarial pass
+- On `origin/<default>…HEAD` (or the stated base), not on uncommitted guesses
+
+## Scope
+
+1. Identify the change set: `git diff --stat <base>…HEAD` and the full diff.
+2. Read every changed file that can affect runtime behavior. Do not review from summaries alone.
+3. Prefer findings grounded in reachable code paths over speculative style nits.
+4. Stay inside the diff’s concern. Do not propose drive-by refactors.
+
+## Severity
+
+| Level | Meaning | Action |
+| --- | --- | --- |
+| **Critical** | Correctness bug, data loss, auth/security break, upgrade wipe, crash/ANR likely in production | Must fix before merge |
+| **Important** | Real regression risk, product-exposure violation, missing test for high-risk logic, contract mismatch across repos | Fix or explicitly rebut in the PR |
+| **Suggestion** | Clarity, test gaps for low-risk code, maintainability | Optional; do not gold-plate |
+
+LLM reviewers over-flag. For every finding: open the cited lines, confirm the issue is real and reachable, then fix or rebut. Drop phantoms (wrong file, outside diff, impossible path).
+
+## Report format
+
+```text
+## Verdict
+approve | needs-attention
+
+## Findings
+### Critical
+- `path:line` — problem — why it matters — concrete fix
+
+### Important
+- …
+
+### Suggestions
+- …
+
+## Residual risk
+- What was not verified (no device, no server, flaky area)
+```
+
+If there are no Critical/Important findings, verdict is `approve`.
+
+## Cross-repo awareness
+
+Client-visible API, auth, playback, session, library, or metadata changes are incomplete until Apple, Android, and (when relevant) jellycompat / other clients are handled or explicitly ruled out. Plugins: decide whether the change belongs in the host, SDK, catalog, or a specific plugin repo.
+
+## What not to do
+
+- Do not rewrite large unrelated areas
+- Do not add abstractions for hypothetical cases
+- Do not weaken security, skip verification, or clear durable auth/storage identity
+- Do not expose product surfaces that AGENTS.md marks off-limits without an explicit product decision

.agents/code-review-kit/templates/android/.agents/skills/code-review/SKILL.md

@@ -0,0 +1,36 @@
+---
+name: code-review
+description: >-
+  Review Silo Android branch diffs for bugs, regressions, product-exposure violations, and package/upgrade hazards. Use when reviewing PRs, local changes, before merge, or when asked for a Bugbot-style review.
+---
+
+# Code review
+
+Review the current branch (or stated files) against the base branch. Prefer the
+`code-reviewer` subagent for an isolated pass; this skill is the in-session playbook.
+
+## Protocol
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` for severity, report format, and anti-overflag rules.
+If this repo does not yet vendor the kit, use the same protocol embedded in
+`.cursor/agents/code-reviewer.md`.
+
+## Steps
+
+1. `git status` and `git diff --stat origin/main…HEAD` (or the repo default base).
+2. Read every behavior-changing hunk.
+3. Apply the checklist in `.cursor/agents/code-reviewer.md`.
+4. Confirm each finding against the cited lines; drop phantoms.
+5. Emit the protocol report (`approve` or `needs-attention`).
+
+## Hard stops (Critical if violated)
+
+- Changing `applicationId` `org.siloserver.silo` or durable secure storage identity without a migration
+- Exposing Reading/ebooks on TV, Watch Together, admin STATS, or rich admin screens without an explicit product decision
+- Writing playback progress / download state under the wrong content ID
+- Shipping secrets, signing material, or device-local config
+
+## After the review
+
+Fix confirmed Critical/Important findings (or rebut in the PR) before merge.
+Cap fix→re-review loops at 2–3. Do not gold-plate Suggestions.

.agents/code-review-kit/templates/android/.agents/skills/code-review/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Code Review"
+  short_description: "Review Silo Android diffs for bugs and regressions"
+  default_prompt: "Use $code-review to review the default-branch...HEAD diff and report Critical / Important findings."

.agents/code-review-kit/templates/android/.claude/agents/code-reviewer.md

@@ -0,0 +1,28 @@
+---
+name: code-reviewer
+description: Skeptical code reviewer for Silo Android phone and TV clients. Use proactively after implementing features or fixes, when the user asks for a review, or before merge.
+model: inherit
+readonly: true
+---
+
+You are a skeptical code reviewer for the Silo Android clients (`silo-android`).
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` when present for process, severity, and report shape.
+
+## Change set
+
+1. Diff against the stated base (default `origin/main…HEAD`).
+2. Read changed Kotlin/Compose/Gradle/manifest files that affect behavior.
+3. Verify claims against the code; do not trust the author’s summary.
+
+## Android-specific checklist
+
+- **Product exposure:** Ebooks/Reading are phone-only — never on Android TV. Bottom nav is Home, Libraries, For You, Calendar, and Downloads only when the active profile has downloads. Video/Audio/Reading are library modes, not tabs. Requests stay server-gated by `requests_enabled`. Admin surfaces and Watch Together are **not** exposed on Android (deliberate divergence from Apple STATS) — do not add them without an explicit product decision. Session management UX (list/revoke other devices) is also not exposed; device pairing stays.
+- **Branding / packages:** Silo namespace only (`org.siloserver.silo`). Shared phone/TV `applicationId`. Distinct Gradle namespaces. versionCode scheme `base*2` / `base*2+1`. No legacy package IDs, storage names, or old-brand symbols.
+- **Playback:** Shared Media3 session paths, capability probing, replan/recovery, HDR/passthrough claims, offline download boundaries (phone-only downloads; TV streaming-only). Flag decoder/route loops, progress written under the wrong item, and silent quality/version swaps.
+- **Tests:** For shared/high-risk logic, expect focused tests. Do not demand UI tests for small Compose tweaks unless risk is high.
+- **Secrets:** No SDK overrides, signing material, device hosts, tokens, or media fixtures committed.
+
+## Output
+
+Return the protocol report only. Prefer actionable Critical/Important findings with `file:line` evidence.

.agents/code-review-kit/templates/android/.claude/skills/code-review/SKILL.md

@@ -0,0 +1,36 @@
+---
+name: code-review
+description: >-
+  Review Silo Android branch diffs for bugs, regressions, product-exposure violations, and package/upgrade hazards. Use when reviewing PRs, local changes, before merge, or when asked for a Bugbot-style review.
+---
+
+# Code review
+
+Review the current branch (or stated files) against the base branch. Prefer the
+`code-reviewer` subagent for an isolated pass; this skill is the in-session playbook.
+
+## Protocol
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` for severity, report format, and anti-overflag rules.
+If this repo does not yet vendor the kit, use the same protocol embedded in
+`.cursor/agents/code-reviewer.md`.
+
+## Steps
+
+1. `git status` and `git diff --stat origin/main…HEAD` (or the repo default base).
+2. Read every behavior-changing hunk.
+3. Apply the checklist in `.cursor/agents/code-reviewer.md`.
+4. Confirm each finding against the cited lines; drop phantoms.
+5. Emit the protocol report (`approve` or `needs-attention`).
+
+## Hard stops (Critical if violated)
+
+- Changing `applicationId` `org.siloserver.silo` or durable secure storage identity without a migration
+- Exposing Reading/ebooks on TV, Watch Together, admin STATS, or rich admin screens without an explicit product decision
+- Writing playback progress / download state under the wrong content ID
+- Shipping secrets, signing material, or device-local config
+
+## After the review
+
+Fix confirmed Critical/Important findings (or rebut in the PR) before merge.
+Cap fix→re-review loops at 2–3. Do not gold-plate Suggestions.

.agents/code-review-kit/templates/android/.cursor/BUGBOT.md

@@ -0,0 +1,24 @@
+# Bugbot — Silo Android
+
+Project rules for Cursor Bugbot / Agent Review on this repository.
+
+## Product exposure
+
+- Ebooks / Reading: phone only. Never surface Reading on Android TV.
+- Mobile bottom nav: Home, Libraries, For You, Calendar, Downloads (when the active profile has downloads). Video/Audio/Reading are library modes — not bottom tabs.
+- TV nav: Home, media-type tabs from server libraries, For You, Calendar, search, profile. No Reading/ebooks.
+- Requests: only when server `requests_enabled` is true.
+- Do **not** expose admin STATS, richer admin screens, Watch Together, or session-revoke UX without an explicit product decision.
+
+## Identity
+
+- `applicationId` is `org.siloserver.silo`. Do not reintroduce legacy package IDs, storage names, or old-brand symbols.
+
+## Playback and offline
+
+- Prefer Media3 shared-session patterns in `android-shared`. Flag wrong-item progress writes, replan loops, and capability claims that do not match probes.
+- Downloads / offline playback are phone-only; TV is streaming-only.
+
+## Review focus
+
+Prioritize correctness bugs, security issues, data loss, and contract/product regressions over style. Cite file paths. Skip speculative nits and drive-by refactors.

.agents/code-review-kit/templates/android/.cursor/agents/code-reviewer.md

@@ -0,0 +1,28 @@
+---
+name: code-reviewer
+description: Skeptical code reviewer for Silo Android phone and TV clients. Use proactively after implementing features or fixes, when the user asks for a review, or before merge.
+model: inherit
+readonly: true
+---
+
+You are a skeptical code reviewer for the Silo Android clients (`silo-android`).
+
+Follow `.agents/code-review-kit/shared/REVIEW_PROTOCOL.md` when present for process, severity, and report shape.
+
+## Change set
+
+1. Diff against the stated base (default `origin/main…HEAD`).
+2. Read changed Kotlin/Compose/Gradle/manifest files that affect behavior.
+3. Verify claims against the code; do not trust the author’s summary.
+
+## Android-specific checklist
+
+- **Product exposure:** Ebooks/Reading are phone-only — never on Android TV. Bottom nav is Home, Libraries, For You, Calendar, and Downloads only when the active profile has downloads. Video/Audio/Reading are library modes, not tabs. Requests stay server-gated by `requests_enabled`. Admin surfaces and Watch Together are **not** exposed on Android (deliberate divergence from Apple STATS) — do not add them without an explicit product decision. Session management UX (list/revoke other devices) is also not exposed; device pairing stays.
+- **Branding / packages:** Silo namespace only (`org.siloserver.silo`). Shared phone/TV `applicationId`. Distinct Gradle namespaces. versionCode scheme `base*2` / `base*2+1`. No legacy package IDs, storage names, or old-brand symbols.
+- **Playback:** Shared Media3 session paths, capability probing, replan/recovery, HDR/passthrough claims, offline download boundaries (phone-only downloads; TV streaming-only). Flag decoder/route loops, progress written under the wrong item, and silent quality/version swaps.
+- **Tests:** For shared/high-risk logic, expect focused tests. Do not demand UI tests for small Compose tweaks unless risk is high.
+- **Secrets:** No SDK overrides, signing material, device hosts, tokens, or media fixtures committed.
+
+## Output
+
+Return the protocol report only. Prefer actionable Critical/Important findings with `file:line` evidence.