feat(agents): consolidate code-review agents and add orientation-first review loop

.cspell.json

@@ -72,6 +72,7 @@
     "activedescendant",
     "agentic",
     "aoda",
+    "ASEC",
     "atheris",
     "cursored",
     "networkidle",

.cspell/general-technical.txt

@@ -201,6 +201,7 @@ git
 gitops
 helm
 Holo
+hotspot
 hotspots
 Fulcio
 gitsign
@@ -1148,6 +1149,7 @@ vums
 vwan
 vxlan
 wafs
+walkback
 walkthrough
 wans
 webgui

.github/CUSTOM-AGENTS.md

@@ -73,15 +73,11 @@ Each phase has two entry points: the `/task-*` prompt commands (`/task-research`
 
 ### Code and Review Agents
 
-| Agent                      | Purpose                                                               | Key Constraint                                            |
-|----------------------------|-----------------------------------------------------------------------|-----------------------------------------------------------|
-| **pr-review**              | 4-phase PR review with tracking artifacts                             | Review-only; never modifies code                          |
-| **pr-walkthrough**         | Narrative PR orientation that builds a reviewer's mental model        | Orientation-only; never renders judgments; experimental   |
-| **prompt-builder**         | Engineers and validates instruction/prompt files                      | Dual-persona system with auto-testing                     |
-| **security-reviewer**      | OWASP vulnerability assessment with subagent-driven verification      | Delegates all reference reading to subagents              |
-| **code-review-functional** | Pre-PR branch diff reviewer for functional correctness and logic gaps | Review-only; five focus areas; optional artifact save     |
-| **code-review-full**       | Orchestrator running functional + standards reviews via subagents     | Merges both reports; delegates to subagents; experimental |
-| **code-review-standards**  | Skills-based standards reviewer for local changes and PRs             | Findings must trace to a loaded skill; experimental       |
+| Agent                 | Purpose                                                                | Key Constraint                                                |
+|-----------------------|------------------------------------------------------------------------|---------------------------------------------------------------|
+| **prompt-builder**    | Engineers and validates instruction/prompt files                       | Dual-persona system with auto-testing                         |
+| **security-reviewer** | OWASP vulnerability assessment with subagent-driven verification       | Delegates all reference reading to subagents                  |
+| **code-review**       | Human-gated review orchestrator dispatching five perspective subagents | Operator confirms scope, perspectives, and depth; review-only |
 
 ### Generator Agents
 
@@ -175,18 +171,6 @@ Each phase has two entry points: the `/task-*` prompt commands (`/task-research`
 
 **Critical:** Dual-persona system with execution and evaluation subagents. Uses sandbox environment for testing. Links to authoritative sources.
 
-### pr-review
-
-**Creates:** Review tracking files in normalized branch folders:
-
-* `.copilot-tracking/pr/review/{normalized-branch}/in-progress-review.md` (living review document with findings)
-* `.copilot-tracking/pr/review/{normalized-branch}/pr-reference.xml` (PR metadata and diff summary, generated via the `pr-reference` skill)
-* `.copilot-tracking/pr/review/{normalized-branch}/handoff.md` (finalized comments for PR submission)
-
-**Workflow:** 4 phases (Initialize → Analyze → Collaborative Review → Finalize)
-
-**Critical:** Review-only. Never modifies code. Evaluates 8 dimensions: functional correctness, design, idioms, reusability, performance, reliability, security, documentation.
-
 ### product-manager-advisor
 
 **Purpose:** Requirements discovery, story quality assurance, and prioritization guidance.
@@ -361,35 +345,17 @@ Users are responsible for verifying their repository's `.gitignore` configuratio
 
 **Critical:** Orchestrator-only pattern. Delegates codebase profiling, skill assessment, adversarial finding verification, and report generation to specialized subagents. Uses OWASP skills (`owasp-agentic`, `owasp-llm`, `owasp-top-10`, `owasp-mcp`, `owasp-infrastructure`, `owasp-cicd`) and the `secure-by-design` skill for vulnerability and design principle references. Supports incremental comparison with prior scan reports.
 
-### code-review-functional
-
-**Creates:** Optional review artifact (user-prompted after report delivery):
-
-* `.copilot-tracking/reviews/<YYYY-MM-DD>-<branch-name>.md` (full report with YAML frontmatter)
-
-**Workflow:** Branch Analysis → Functional Review → Report Generation → Save Review
-
-**Critical:** Review-only. Focuses on five areas: Logic, Edge Cases, Error Handling, Concurrency, and Contract. Accepts a configurable `baseBranch` input (default `origin/main`). Artifact save is optional and user-confirmed after the report is presented. Applies false-positive filters before recording any finding.
-
-### code-review-full
+### code-review
 
 **Creates:** Merged review artifacts in a normalized branch folder:
 
-* `.copilot-tracking/reviews/code-reviews/<sanitized-branch>/` (per the shared persistence protocol in `review-artifacts.instructions.md`)
-
-**Workflow:** Compute Diff → Delegate to Functional + Standards subagents → Merge Reports → Persist Artifacts
-
-**Critical:** Orchestrator-only. Delegates functional review to `code-review-functional` and standards review to `code-review-standards`, then merges both reports into a single output. Shares the computed diff with subagents to avoid duplicate git operations. Maturity: experimental.
-
-### code-review-standards
-
-**Creates:** Review artifacts in a normalized branch folder:
-
-* `.copilot-tracking/reviews/code-reviews/<sanitized-branch>/` (per the shared persistence protocol in `review-artifacts.instructions.md`)
+* `.copilot-tracking/reviews/code-reviews/<sanitized-branch>/review.md` (merged review document, per the shared persistence protocol in `review-artifacts.instructions.md`)
+* `.copilot-tracking/reviews/code-reviews/<sanitized-branch>/metadata.json` (review metadata record)
 
-**Workflow:** Understand Intent → Lock Scope → Apply Skills → Persist Artifacts
+**Workflow:** Context Bootstrap → Human Scope Confirmation → Perspective + Depth Selection → Prepare Dispatch State → Dispatch Selected Perspectives → Merge and Persist
 
-**Critical:** Every finding must trace to a loaded skill; no invented categories. Loads at most 8 skills per review, preferring those whose domain appears most frequently in the diff. Accepts pre-computed diffs from orchestrators such as the `code-review-full` prompt. Skips artifact persistence for selected code and `#file` reviews that lack branch context. Maturity: experimental.
+**Critical:** Human-gated orchestrator invoked from the agent picker. After computing the diff via the `pr-reference` skill, it confirms scope with the operator, then lets the operator choose any combination of five perspectives (`functional`, `standards`, `accessibility`, `security`, `pr`) or `full` to run all five, plus a depth tier (`basic`, `standard`, or `comprehensive`) applied independently of perspective.
+It dispatches thin perspective subagents under `.github/agents/coding-standards/subagents/`, shares the computed diff to avoid duplicate git operations, and merges every report into a single output. Review-only; never modifies code. Maturity: experimental.
 
 ### gen-jupyter-notebook
 
@@ -502,10 +468,10 @@ Users are responsible for verifying their repository's `.gitignore` configuratio
 
 ### Code Review
 
-1. Select **pr-review** from agent picker
-2. Automatically runs 4-phase protocol
-3. Collaborate during Phase 3 (review items)
-4. Receive `handoff.md` with final PR comments
+1. Select **code-review** from agent picker
+2. Confirm the change scope when prompted
+3. Choose perspectives (`functional`, `standards`, `accessibility`, `security`, `pr`, or `full`) and a depth tier
+4. Receive a merged `review.md` under `.copilot-tracking/reviews/code-reviews/<branch>/`
 
 ### Creating Instructions