feat: load review methodology from factory-mono builtin skill

[factory-nizar]

Summary

Migrates review methodology from inline prompts to the review builtin skill in factory-mono (PR #11498).

Changes

• Candidate and validator prompts are now thin wrappers that invoke the review skill for Pass 1 (candidate generation) and Pass 2 (validation)
• All review methodology, triage, parallel review, validation rules, dedup, and confidence filtering come from the skill
• Removed load-skill.ts — no GitHub fetch needed, CLI bundles the skill as a builtin
• Templates retain session framing (senior staff software engineer / validating candidate review comments) for session querying
• Suggestion block rules toggled via include_suggestions (defaults true for CI)

Depends on

• factory-mono #11498 (adds review builtin skill)

Verified

• CI run with code smell test — skill loaded, both passes completed, findings posted correctly

[factory-droid]

Droid finished @factory-nizar's task —— View job

---

Droid reviewed this PR and found 3 issues (3 P1).

Summary: The skill-loader integration has a genuine path-resolution bug (HOME fallback to ~ doesn't expand in Node/Bun) and both prompt templates can silently lose their review methodology when skill loading fails, since the previously hardcoded guidance was removed without a fallback. Consider using os.homedir() and either failing fast on missing skills or keeping a minimal inlined methodology.

[factory-droid]

The skill-loader integration has a genuine path-resolution bug (HOME fallback to ~ doesn't expand in Node/Bun) and both prompt templates can silently lose their review methodology when skill loading fails, since the previously hardcoded guidance was removed without a fallback. Consider using os.homedir() and either failing fast on missing skills or keeping a minimal inlined methodology.

[jonathan-factory]

Looks good, might be good to confirm that the plugin gets properly loaded before the action runs

Possible that it only gets installed in interactive mode

[factory-nizar]

i'll test on the mono-repo now that the plugin is merged!

[factory-nizar]

CI Verification

Tested end-to-end on factory-mono PR #11503 which points droid-review.yml at this branch.

Results

• Droid Auto Review workflow: Passed
• Two-pass pipeline: Both candidate generation and validation completed successfully
• Skill tool: Included in enabled tools (--enabled-tools ...Skill) for candidate pass
• Prompt instructions: Both passes include invoke the 'review' skill to load the review methodology
• Review posted: [P1] finding about unpinned action reference — follows the skill's security bug pattern (supply-chain risk)

Log evidence

Candidate pass prompt:

Before starting, invoke the 'review' skill to load the review methodology. 
Follow its bug patterns, analysis discipline, reporting gate, and priority levels throughout your review.

Validator pass prompt:

Before starting, invoke the 'review' skill to load the review methodology. 
Apply its reporting gate, confidence calibration, and deduplication rules.

CLI exec command:

droid exec --output-format stream-json --skip-permissions-unsafe   --enabled-tools Read,Grep,Glob,LS,Execute,Edit,Create,ApplyPatch,...,Task,FetchUrl,Skill   --tag code-review --model gpt-5.2 --reasoning-effort high   -f /home/runner/_work/_temp/droid-prompts/droid-prompt.txt

[factory-nizar]

These are ci specfic

[factory-nizar]

CI Verification (Final — With Code Smell Test)

Tested end-to-end on factory-mono PR #11503 with a deliberate code smell file to verify skill-driven findings.

Workflow Run: Passed

Log Evidence

Candidate pass:

You are a senior staff software engineer and expert code reviewer.
Invoke the 'review' skill to load the review methodology, then execute its
**Pass 1: Candidate Generation** procedure — including suggestion block rules.

Validator pass:

You are validating candidate review comments for PR #11503 in Factory-AI/factory-mono.
Invoke the 'review' skill to load the review methodology, then execute its
**Pass 2: Validation** procedure — including suggestion block rules.

What This Proves

1. Skill loaded: The review builtin skill was invoked via the Skill tool at runtime
2. Two-pass pipeline: Both candidate generation (Pass 1) and validation (Pass 2) completed
3. Methodology applied: Findings follow skill's priority levels, reporting gate, and bug patterns
4. Suggestions enabled: Skill invocation includes suggestion block rules
5. Thin wrappers work: Templates only provide context + output schema; all review logic comes from the skill

[factory-nizar]

Bundle Verification — Builtin Review Skill

Built CLI from feat/review-builtin-skill branch in CI to confirm the review SKILL.md is correctly bundled.

CI Run — Passed

Build step output:

Bundle created
1
Review skill found in bundle

grep -c "BEGIN_SHARED_METHODOLOGY" bundle/droid.js returned 1 — the builtin review skill content (methodology, two-pass pipeline, bug patterns, reporting gate) is compiled into the CLI bundle.

Review step output:

You are a senior staff software engineer and expert code reviewer.
Invoke the 'review' skill to load the review methodology, then execute its
**Pass 1: Candidate Generation** procedure — including suggestion block rules.

You are validating candidate review comments for PR #11503 in Factory-AI/factory-mono.
Invoke the 'review' skill to load the review methodology, then execute its
**Pass 2: Validation** procedure — including suggestion block rules.

Both passes completed successfully. Once factory-mono PR #11498 merges, the released CLI will include the builtin skill and the Skill tool will load it directly instead of from factory-plugins.