From ac9889918878d1cfcbc40a2fd011cf32b7d1a52d Mon Sep 17 00:00:00 2001
From: Matt Miermans <m.miermans@gmail.com>
Date: Mon, 8 Jun 2026 10:49:01 -0700
Subject: [PATCH 1/3] exp(stick-structured): deterministic delivery via
 structured output

---
 .github/workflows/claude-review.yml           | 44 +++++++++++--------
 .../resources/js/exp-stick-structured.js      |  4 ++
 2 files changed, 29 insertions(+), 19 deletions(-)
 create mode 100644 webclient/resources/js/exp-stick-structured.js

diff --git a/.github/workflows/claude-review.yml b/.github/workflows/claude-review.yml
index 9dccd59..567f10d 100644
--- a/.github/workflows/claude-review.yml
+++ b/.github/workflows/claude-review.yml
@@ -1,39 +1,45 @@
 name: Claude PR Review
 on:
   pull_request:
-
-# Cancel in-progress reviews for the same PR when a new push arrives.
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
   cancel-in-progress: true
-
 jobs:
   claude-review:
     name: Claude PR Review
     runs-on: ubuntu-latest
-
-    # Prevent running on fork PRs where secrets are unavailable
     if: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
-
     permissions:
       contents: read
       pull-requests: write
-      id-token: write # OIDC token for Claude GitHub App auth
-
+      issues: write
     steps:
       - uses: actions/checkout@v4
-
       - uses: anthropics/claude-code-action@v1
+        id: claude
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-          prompt: "/review"
-          # Pre-loads full PR context and shows a progress tracker.
-          track_progress: true
-          # Only include comments from trusted team members in Claude's context (prompt injection mitigation).
-          include_comments_by_actor: "mmiermans"
-          # Update the same comment on each push instead of creating new ones.
-          use_sticky_comment: true
-          # Inline code comments, PR comments, reading PR diffs, and git log for commit messages.
-          # gh pr view is excluded to prevent Claude from fetching PR comments (prompt injection risk).
+          github_token: ${{ github.token }}
+          prompt: |
+            You are an automated code reviewer for pull request #${{ github.event.pull_request.number }} in ${{ github.repository }}.
+            Read the changes: gh pr diff ${{ github.event.pull_request.number }}. Review concisely for bugs, security, performance, quality, tests, docs. Do not invent issues.
+            Return the structured output field comment_body containing the ENTIRE PR comment body: the first line must be the hidden marker <!-- claude-review --> then a collapsed details block whose summary line is exactly "🤖 Claude has reviewed this PR — expand after forming your own opinion" with your full review inside and nothing visible outside it.
+            Do NOT post any PR comment yourself; the workflow will post it.
           claude_args: |
-            --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(git log:*)"
+            --allowedTools "Bash(gh pr diff:*)"
+            --json-schema '{"type":"object","additionalProperties":false,"required":["comment_body"],"properties":{"comment_body":{"type":"string"}}}'
+      - name: Post or update single sticky comment
+        if: ${{ steps.claude.outputs.structured_output != '' }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+          SO: ${{ steps.claude.outputs.structured_output }}
+          PR: ${{ github.event.pull_request.number }}
+          REPO: ${{ github.repository }}
+        run: |
+          printf '%s' "$SO" | jq -r '.comment_body' > body.md
+          ID=$(gh api repos/$REPO/issues/$PR/comments --jq '[.[] | select(.user.login=="github-actions[bot]" and (.body | contains("<!-- claude-review -->")))] | last | .id // empty')
+          if [ -n "$ID" ]; then
+            gh api -X PATCH repos/$REPO/issues/comments/$ID -f body="$(cat body.md)"
+          else
+            gh pr comment "$PR" --body-file body.md
+          fi
diff --git a/webclient/resources/js/exp-stick-structured.js b/webclient/resources/js/exp-stick-structured.js
new file mode 100644
index 0000000..afefc8d
--- /dev/null
+++ b/webclient/resources/js/exp-stick-structured.js
@@ -0,0 +1,4 @@
+// helper for sticky-review experiment
+function pct(part, total) {
+  return (part / total) * 100;  // no guard for total === 0
+}

From f5c28a5388ee743a7ef1213bdabaa236f6dcd1b3 Mon Sep 17 00:00:00 2001
From: Matt Miermans <m.miermans@gmail.com>
Date: Mon, 8 Jun 2026 10:50:53 -0700
Subject: [PATCH 2/3] trigger run 2


From 9a09f9e8b2e410ea6e8f14974a794d5fe515bac5 Mon Sep 17 00:00:00 2001
From: Matt Miermans <m.miermans@gmail.com>
Date: Mon, 8 Jun 2026 10:52:39 -0700
Subject: [PATCH 3/3] trigger run 3