[CamSoper]

Proposed changes

G1 (review-ran) was demanding a review on PRs the review lane skips on purpose. Those PRs sat red until someone waived them or forced a full review of a one-line change. #22417 is what started this: Chris waived a date: bump because review:frontmatter-only had no G1 branch at all, so waiving was the only sane move. I audited every skip reason in claude-code-review.yml against the G1 ladder and found three dead ends plus one fail-open.

Lane	Before	After
review:frontmatter-only (#22417)	G1 red forever. No branch, and date: is outside the mechanical bar's {updated, tags}	G1 ok when the diff really is frontmatter-only. G3 still needs a human
Clean review:trivial that misses the mechanical bar (#22429, open now: "two ways" → "three ways")	G1 red. The stand-in required triage's prose comment, which triage only posts when it finds something. The claims signal and deletions cap make plenty of trivial PRs non-mechanical	G1 ok when the diff really is trivial. G3 still needs a human
pulumi-bot PRs outside content-review/, fix/broken-links-, vale/brand-sync- (e.g., the marketing-web editions sync, #22204)	G1 red forever. Triage and the review lane both skip these	G1 ok. G3 still needs a human
Zero changed files	Internal: red with misleading advice. Fork: every gate skipped → success with nobody involved (and on a transiently empty files read, over a real diff)	Red in every lane, with an honest message

Guardrails:

• The label isn't trusted on its own. Anyone with triage access can apply review:trivial / review:frontmatter-only, so the Sentinel re-runs triage's own classify_pr on the diff and only passes G1 when the shape really fits. If it doesn't, G1 stays red and points at /new-review. A file GitHub sends without a patch reads as binary, so it never fits.
• A review card at any head keeps the PR on the review track, same rule the trivial stand-in already had. A stale card with an open finding can't pass on a skip label.
• review:prose-flagged with the triage comment missing stays red. The label promises nits that only the comment can show.
• G3 is unchanged. A skipped review moves the reading to the approver; it never removes it.

Plumbing:

• review-sentinel.yml: the label-event filter wakes on review:frontmatter-only.
• claude-triage.yml: triage re-dispatches the Sentinel when review:frontmatter-only or review:prose-flagged moves, not just review:trivial. Its GITHUB_TOKEN label writes fire no events.
• REVIEW_LANE_SKIPPED_BOTS / REVIEW_LANE_REVIEWED_BOT_BRANCHES mirror the review lane's bot-author rule. A test pins them to both claude-code-review.yml and triage's if:, so a branch added in one place and not the others fails the suite instead of creating a new dead end.
• Docs: the sentinel.py docstring, scripts/review-v3/README.md gate table, and CONTRIBUTING §short-circuits.

Testing

• 10 new or updated tests in test_sentinel.py, including verbatim-shape regressions for Update the date for the AICR blog #22417 and Content review: content/docs/iac/guides/migration/_index.md #22429. All 9 behavior tests fail against the old sentinel.py and pass now.
• Replayed the real payloads of Update the date for the AICR blog #22417, Content review: content/docs/iac/guides/migration/_index.md #22429, and chore: sync Pulumi Cloud editions #22204 through the patched evaluator with the live review-routing.yml: each is red until someone with write access approves, then green.
• make test-review-pipeline: all suites pass (613 in scripts/review-v3/). make lint: clean.

Worth a look

The "approver is the review" call means a trivial PR carrying a factual claim (like #22429's count fix) now clears G1 without a model review. Before, it needed /new-review or a waive. That matches what the review lane already decided by skipping it, and content-review PRs like #22429 were fact-checked by their own pipeline. If you'd rather claims get a model pass, the place to change it is the lane's skip bar (or swapping the v2 shortcuts for the mechanical bar, which replay-mechanical.py was built to evaluate), not a G1 that can never pass.

Related issues (optional)

#22417 (waived over this), #22429 (stuck on it right now), #22204 (bot-author shape).

---

Generated by Claude Code

[github-actions]

Sentinel — merge gate status

2 of 5 gates need attention before this can merge.

	Gate	What it needs
🔴	G1 review-ran	No current review for faccb35ba — comment /update-review <what changed> to refresh it, or /new-review for a fresh one.
➖	G2 findings-answered	Doesn't apply to this PR: no review present — see G1.
🔴	G3 right-approver	Needs an approval from anyone with write access to this repo — no qualifying human approval at this head (bot approvals count only on the automated lanes bot_approvers lists).
➖	G4 infra-evidence	Doesn't apply to this PR: no changed path affects the deploy.
➖	G5 oversized-ack	Doesn't apply to this PR: not oversized.

Break glass: a member of a routing team (.github/review-routing.yml teams:) can apply review:waived, which is logged.

_{Evaluated at head faccb35ba.}

---

Need help, or think a gate got it wrong? Ask in #docs on Slack.

[pulumi-bot]

Your site preview for commit faccb35 is ready! 🎉

http://www-testing-pulumi-docs-origin-pr-22445-faccb35b.s3-website.us-west-2.amazonaws.com