feat(bitwarden-code-review): route changed SKILL.md to plugin-dev:skill-reviewer

[withinfocus]

🎟️ Tracking

Stacked on #201, which must merge first. This branch is based on config-validator-guardrails rather than main, so the diff shown here is only this layer.

Closes the follow-up #201 records under ### Migration in the claude-config-validator changelog.

Paired with bitwarden/gh-actions#907, which installs plugin-dev in the code-review action so the new routing actually fires in CI.

No Jira ticket, matching #197, #198, and #201.

📔 Objective

claude-config-validator 2.0.0 stops reviewing SKILL.md and hands the file to plugin-dev:skill-reviewer. bitwarden-code-review sends SKILL.md to Skill(claude-config-validator:reviewing-claude-config) in both of its review paths and invokes plugin-dev:skill-reviewer in neither. After #201 that leaves a skill change with a stated omission instead of a review, while both paths go on advertising that they check progressive-disclosure structure.

Multi-agent pipeline

Step 3 gains Agent 5, conditional on a changed SKILL.md and an installed plugin-dev, running on the plugin-dev:skill-reviewer subagent type.

That agent will not fit the pipeline's contract as-is, and the paragraph says why rather than pretending otherwise. It declares tools: ["Read", "Grep", "Glob"], so it cannot invoke the security-context skill the Review Rules mandate, and its system prompt fixes its output as a prose report, so asking it for Finding Shape JSON would put two output contracts in one context. Markdown carries no id, and Steps 4 and 6 merge on id, so its findings would have dropped out of the merge unnoticed.

So it gets a named carve-out receiving Line Number Accuracy, Tool Discipline minus its gh/git bullet, and Untrusted Input Boundary widened from diff hunks to whole files, since it reads files rather than hunks. The orchestrator translates its prose in Step 3: scope fence first, because a whole-skill reviewer cannot see what changed and would otherwise fill Step 4 with findings to dismiss; then severity judged against this pipeline's own definitions rather than a fixed map, because its Critical is not this pipeline's Blocker; then id, source_agent, file, line, title, detail, and confidence. The carve-out is explicitly not extensible to any agent that emits Finding Shape objects itself.

finding-shape.md gains skl → skill and report-template.md renders it as "Skill review agent". Step 6 merges by id, so a second agent emitting cfg-N would have collided with Agent 4.

plugin-dev joins claude-config-validator as an optional enhancer, detected by resolvability and excluded from the prerequisite abort check.

Single-agent reviewer

bitwarden-code-reviewer does not get skill content review, and says so.

Reaching plugin-dev:skill-reviewer needs Task, because it is an agent rather than a skill. Granting Task there is not worth it: a spawned subagent takes its tool set from its own definition, and general-purpose declares Tools: *, so the grant would put unrestricted Bash, Write, and WebFetch one hop from an agent whose whole tool line is a deliberately narrow Bash(gh pr view:*) allowlist. That agent runs unattended in Actions over contributor-authored diffs, and the plugin's settings.json does not contain the blast radius: it denies gh subcommands only, and it sits inside the plugin directory rather than the repository under review.

The path now reports in its Step 6 summary that description quality, length, and progressive disclosure went unreviewed, names the pipeline as what covers them, and is told not to substitute its own opinion of skill quality. Clean PRs: brief approval only carries a clause so a clean SKILL.md-only pull request cannot swallow the note.

Bucketing

SKILL.md leaves the Claude-configuration bucket for content review in both paths, but stays in the scope handed to reviewing-claude-config. That skill's credential scan is its Step 2 and covers every file whatever the type; only its Step 3 routing declines SKILL.md. Dropping the file from that scope would have removed it from the secret scan.

The support-file detection list covers reference/ and references/ both. Thirteen of the fourteen support directories in this repo use the plural, including the two this PR changes, and claude-config-validator is the lone exception.

Version 1.13.1 to 1.14.0.

Deferred

Both pre-existing, both want their own change. Agent 4 has the same two-output-contracts problem the Agent 5 paragraph now names, since reviewing-claude-config emits four severities and declines to score confidence while the pipeline expects three and a threshold. And performing-multi-agent-code-review declares allowed-tools without Task while launching subagents throughout Steps 2 to 5.

[github-actions]

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

Re-reviewed at 4f1dc87. The Task grant is gone from the agent frontmatter and the single-agent path now declares skill content review as out of reach rather than delegating to it, which removes the general-purpose (Tools: *) escalation path from an agent whose tool line is otherwise a narrow Bash(gh pr view:*) allowlist running unattended over contributor diffs. The Agent 5 contract in the pipeline is internally consistent now — scope fence before translation, severity judged against evaluation-standards.md rather than a fixed map, the carve-out keeping Tool Discipline minus its gh/git bullet, and SKILL.md still reaching reviewing-claude-config for the Step 2 credential scan. All five earlier threads are resolved and their fixes verified; no new findings.

Code Review Details

No findings.

Verified this pass:

• AGENT.md:7 no longer grants Task; no remaining reference to the delegation in the agent or the plugin, and commands/code-review/code-review.md retains Task only for the user-driven invocation of the agent.
• AGENT.md:42, :83, :87, :179 agree: SKILL.md goes into the reviewing-claude-config scope for the credential scan, content review is stated as not run, and a clean SKILL.md-only PR cannot swallow the note. The earlier "false skill-coverage-absent finding" concern no longer applies on this path, since skill-reviewer genuinely does not run here.
• SKILL.md:18, :20, :177, :182, :224 and references/report-template.md:49-51 agree on the Agent 5 coverage line and on Agent 4 remaining a silent skip.
• finding-shape.md skl → skill and the report-template.md friendly-name row are both present, so a skl-N id cannot collide with Agent 4's cfg-N at the Step 6 merge.
• All references/ and examples/ paths cited from SKILL.md resolve. No secrets, no settings.local.json, no new tool grants.
• Version 1.14.0 is consistent across marketplace.json, plugin.json, README.md, and the agent frontmatter, with a matching CHANGELOG.md entry.

Coverage note: plugin-dev:skill-reviewer was not resolvable in this review session, so description quality, content length, and progressive-disclosure structure of the changed performing-multi-agent-code-review/SKILL.md were not reviewed. performing-multi-agent-code-review is the path that covers them; bitwarden/gh-actions#907 installs plugin-dev in the code-review action.

The two items the PR body defers — Agent 4's two-output-contracts mismatch, and performing-multi-agent-code-review declaring allowed-tools without Task while launching subagents in Steps 2–5 — are both pre-existing and out of scope here.