ISS-7382: resolve review paths against the reviewed worktree

CHANGELOG.md

@@ -4,6 +4,15 @@ All notable changes to the claude-plugins project will be documented in this fil
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/). Entries are listed newest-first; each plugin section is treated as released when merged to `main`.
 
+### code-review v3.8.0
+
+#### Fixed
+- **Reviewers and verifiers resolved source paths against the invoking session's working directory instead of the checkout under review (ISS-7382).** `resolve-scope` emitted `review_root: ""` for every scope kind except local PR-head worktree isolation, and both prompts read that as "read repo-relative paths from the working directory". A reviewer/verifier is a spawned Task, so its working directory is the SESSION's checkout — for any worktree-based run, a different tree than the diff came from. The fleet was pointed at unrelated code, and a reviewer that reads unrelated code returns a confident clean report, which is exactly the signal a caller uses to decide it is done. `resolve-scope` now resolves `review_root` for **every** scope kind — the PR-head worktree when one was created, otherwise `git rev-parse --show-toplevel` of the invoking checkout — records the tip it resolved at as `review_root_sha`, and returns non-zero rather than emit an empty root. Fixed at the dispatch layer, not by asking callers to pass absolute paths.
+- **A wrong checkout now fails the run loudly instead of producing a zero-finding review.** Every stage that hands work to an agent — `derive-spawn-spec`, `derive-static-spec`, `verify-prepare`, `review-dismissed-prepare` — re-proves the root before dispatching: it must be an absolute path free of prompt markup, exist, be the root of a git worktree, still be on `review_root_sha`, and contain every non-removed file in `diff_data.json`. Any failure exits `3`, and the walker aborts on exit `3` regardless of the stage's `on_failure` — those three dispatch stages are `on_failure: continue`, and every path a continue degrades to (the static reviewer table, "no verifier this run") spawns the same agents against the same wrong tree, so the guard would otherwise be toothless. An empty or absent `review_root` is a hard error, never a silent fallback to cwd. `derive-spawn-spec`'s "a derive failure must never block review" fallback explicitly does not cover this case, because the static reviewer table would spawn the same agents against the same wrong tree. The spawn spec now carries `review_root` so the dispatching skill substitutes the proven value rather than re-deriving one, and both `shared_prompt.txt` and `verifier_prompt.txt` now tell the agent the root is mandatory, to discard anything it resolved elsewhere, and to stop rather than fall back to its own directory.
+- **A positional revision range (`/code-review origin/main...HEAD`) is rejected instead of reviewing an empty diff.** It parsed as a pathspec, matched nothing, and reported clean with no error. `resolve-scope` now refuses a positional scope token that is a git ref or range and does not exist as a path, and points at `--base`.
+- **Follow-ups from the review fleet, all in this entry's scope.** The reviewer/verifier prompts' stop-path no longer writes an empty `findings` array (the collector reads only `findings`, so that was byte-identical to a clean review) — reviewers write no output file, which the existing `spawn_missing_required_agent` path turns into a coverage gap, and verifiers write the closed-vocabulary `TENTATIVE` rather than an invented verdict consolidation discards. The containment check skips git C-quoted paths (a non-ASCII filename is not the name on disk, and an entry that cannot be resolved must not produce a confident refusal) and uses `lexists`, so a dangling symlink in the diff does not abort a correct root. The recorded-commit check is equality only for a PR-head worktree (a detached checkout nobody commits into) and reachability for a live checkout, so committing mid-review is not fatal. A root that could be proven by neither a recorded commit nor a resolvable changed file is refused rather than reported as proven. The prompt-markup filter now rejects every C0 control plus `<>` and a backtick. `_ref_like_scope_arg` asks git to resolve a side of the token rather than keying on the `..` substring, so a bare `origin/main` is caught and a relative pathspec is not. The graph-path validation rules in `shared_prompt.txt` and both worker agent definitions resolve under `<review_root>` instead of the working directory, `prefix_golden_harness.py` mirrors the exit-3 abort in both of its walkers, `SCHEMA.md` §6b documents `spec.review_root`, and `verify-findings` / `present-local` gained stop-rules for the missing manifest and the non-zero prepare.
+- The destructive-teardown validator keeps its old narrow contract under the name `_validated_worktree_path` (only `<cr_dir>/pr_head_worktree` is accepted, because `stage_30_footer` deletes what it accepts); the widened read-side resolution is a separate function that no teardown path consumes. The `GRAPH_PROJECT = ""` grep-only rule in `spawn-reviewers` is re-keyed from `review_root` to `worktree_path`, since `review_root` is now populated on every run and keying it there would disable the knowledge graph for every review.
+
 ### code v1.14.10
 
 #### Added

plugins/code-review/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "code-review",
   "description": "Code review plugin",
-  "version": "3.7.0",
+  "version": "3.8.0",
   "author": {
     "name": "ClosedLoop",
     "email": "support@closedloop.ai"

plugins/code-review/SCHEMA.md

@@ -316,6 +316,12 @@ ignored at spawn time.
   "fallback_reason": "<string>",       // only present when arbitrate_status="fallback"
   "cr_dir": "<absolute path>",
   "generated_at": "<ISO-8601 timestamp>",
+  "review_root": "<absolute path>",    // the checkout the diff was PROVEN
+                                       // against; present on fallback specs
+                                       // too, and the primary source for the
+                                       // mandatory {REVIEW_ROOT} substitution
+                                       // at stage_20. Never empty — derivation
+                                       // exits 3 instead of emitting one.
 
   // ── Agents to spawn ──────────────────────────────────────
   "agents": [

plugins/code-review/agents/code-review-worker-graph.md

@@ -39,9 +39,10 @@ analysis.
   - Pass `project=<GRAPH_PROJECT>` on EVERY graph call. Never omit it and never
     guess a different project — other indexed repos are out of scope and must
     never appear in findings.
-  - Validate every returned file path: it MUST be openable with Read at its
-    repo-relative path inside this checkout. Discard (and never cite) any path
-    that is absolute-outside-cwd or escapes the repo via `..`.
+  - Validate every returned file path against the task prompt's `<review_root>`,
+    never your working directory: it MUST be openable with Read at
+    `<review_root>/<repo-relative path>`. Discard (and never cite) any path that
+    does not resolve under `<review_root>` or escapes it via `..`.
   - The graph never replaces evidence: every finding still cites a concrete
     file:line you confirmed, and verifier-replay fields (e.g. `grep_query_used`)
     stay populated per your role prompt.

plugins/code-review/agents/code-review-worker.md

@@ -14,6 +14,7 @@ You are a code review worker agent. Your job is to read pre-extracted patch file
 1. Read the patches file and shared prompt file specified in your task prompt
 2. Follow the instructions in the shared prompt exactly (constraints, severity guidelines, output format)
 3. Use Read, Grep, and Glob to explore the codebase for context when needed
+   - Repo-relative source paths resolve under the task prompt's `<review_root>`, NEVER your working directory — a spawned agent's cwd is the invoking session's checkout, not the code under review.
 4. Write your findings JSON to the output file specified in `<output_file>`
 5. Respond with a one-line summary: `DONE findings={count} file={path}`