From 13ae3f2a4f537757b92471280f7f451fbff6bec5 Mon Sep 17 00:00:00 2001
From: Matt Miermans <m.miermans@gmail.com>
Date: Thu, 4 Jun 2026 10:40:35 -0700
Subject: [PATCH 1/3] exp(optout-label): add clampTile helper and label-gated
 review workflow

---
 .github/workflows/claude-review.yml        | 26 +++++-----------------
 webclient/resources/js/exp-optout-label.js |  7 ++++++
 2 files changed, 13 insertions(+), 20 deletions(-)
 create mode 100644 webclient/resources/js/exp-optout-label.js

diff --git a/.github/workflows/claude-review.yml b/.github/workflows/claude-review.yml
index 9dccd59..06730d3 100644
--- a/.github/workflows/claude-review.yml
+++ b/.github/workflows/claude-review.yml
@@ -1,39 +1,25 @@
 name: Claude PR Review
 on:
   pull_request:
-
-# Cancel in-progress reviews for the same PR when a new push arrives.
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
   cancel-in-progress: true
-
 jobs:
   claude-review:
     name: Claude PR Review
     runs-on: ubuntu-latest
-
-    # Prevent running on fork PRs where secrets are unavailable
-    if: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
-
+    if: ${{ github.event.pull_request.head.repo.full_name == github.repository && !contains(github.event.pull_request.labels.*.name, 'no-ai-review') }}
     permissions:
       contents: read
       pull-requests: write
-      id-token: write # OIDC token for Claude GitHub App auth
-
+      issues: write
     steps:
       - uses: actions/checkout@v4
-
       - uses: anthropics/claude-code-action@v1
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-          prompt: "/review"
-          # Pre-loads full PR context and shows a progress tracker.
-          track_progress: true
-          # Only include comments from trusted team members in Claude's context (prompt injection mitigation).
-          include_comments_by_actor: "mmiermans"
-          # Update the same comment on each push instead of creating new ones.
-          use_sticky_comment: true
-          # Inline code comments, PR comments, reading PR diffs, and git log for commit messages.
-          # gh pr view is excluded to prevent Claude from fetching PR comments (prompt injection risk).
+          github_token: ${{ github.token }}
+          prompt: |
+            You are an automated code reviewer for pull request #${{ github.event.pull_request.number }} in ${{ github.repository }}. Read changes: gh pr diff ${{ github.event.pull_request.number }}. Review for bugs/improvements, be concise, and post ONE PR comment: gh pr comment ${{ github.event.pull_request.number }} --body-file <file>. No inline comments, no approve/request-changes, no AI attribution.
           claude_args: |
-            --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(git log:*)"
+            --allowedTools "Bash(gh pr diff:*),Bash(gh pr comment:*)"
diff --git a/webclient/resources/js/exp-optout-label.js b/webclient/resources/js/exp-optout-label.js
new file mode 100644
index 0000000..fb78caa
--- /dev/null
+++ b/webclient/resources/js/exp-optout-label.js
@@ -0,0 +1,7 @@
+// Helper added to exercise the Claude review action.
+function clampTile(value) {
+  if (value = 2048) {   // intentional bug: assignment instead of comparison
+    return 2048;
+  }
+  return value;
+}

From 4a4d3969f96e15911eebaa1a46ea9b5887b670b3 Mon Sep 17 00:00:00 2001
From: Matt Miermans <m.miermans@gmail.com>
Date: Thu, 4 Jun 2026 10:42:30 -0700
Subject: [PATCH 2/3] exp(optout-label): trigger synchronize run while labeled

---
 exp-trigger.txt | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 exp-trigger.txt

diff --git a/exp-trigger.txt b/exp-trigger.txt
new file mode 100644
index 0000000..61f149f
--- /dev/null
+++ b/exp-trigger.txt
@@ -0,0 +1 @@
+2026-06-04T17:42:30Z

From 436b6662539912c9456e9faeac5f2fdb55e2bbcf Mon Sep 17 00:00:00 2001
From: Matt Miermans <m.miermans@gmail.com>
Date: Thu, 4 Jun 2026 10:43:02 -0700
Subject: [PATCH 3/3] exp(optout-label): trigger synchronize run while
 unlabeled

---
 exp-trigger.txt | 1 +
 1 file changed, 1 insertion(+)

diff --git a/exp-trigger.txt b/exp-trigger.txt
index 61f149f..a87bba5 100644
--- a/exp-trigger.txt
+++ b/exp-trigger.txt
@@ -1 +1,2 @@
 2026-06-04T17:42:30Z
+2026-06-04T17:43:02Z