jq parses the test() argument as a JSON string, so \s and \b must be
double-escaped (\\s, \\b) to produce literal \s and \b after JSON
string parsing. Single backslash forms are invalid JSON escapes and
cause a compile error.

@@ -25,0 +33,4 @@
+      allow_review: ${{ steps.gate.outputs.allow_review }}
+      reason: ${{ steps.gate.outputs.reason }}
+    steps:
+      - name: Install jq

@@ -25,0 +40,4 @@
+        env:
+          GITEA_TOKEN: ${{ secrets.RODIN_TOKEN }}
+        run: |
+          set -e

@@ -25,0 +52,4 @@
+          PR_JSON=$(curl -sS -H "Authorization: token $GITEA_TOKEN" "$API/repos/$REPO/pulls/$PR")
+          SHA=$(echo "$PR_JSON" | jq -r .head.sha)
+          UPDATED_AT=$(echo "$PR_JSON" | jq -r .updated_at)
+          NOW=$(date -u +%s)

@@ -25,0 +59,4 @@
+
+          COMMENTS=$(curl -sS -H "Authorization: token $GITEA_TOKEN" "$API/repos/$REPO/issues/$PR/comments?limit=200")
+          HAS_SR=$(echo "$COMMENTS" | jq -r --arg sha "$SHA" '[.[] | select(.user.login=="rodin") | select(.body|contains("Self-review against "+$sha)) | select(.body|test("(?im)^###\\s+Doc consistency\\b"))] | length')
+

@@ -0,0 +15,4 @@
+        run: |
+          set -euo pipefail
+          python3 - <<'PY'
+import sys, yaml, re

@@ -8,4 +13,4 @@
 
 jobs:
   test:
     runs-on: ubuntu-24.04

@@ -10,3 +15,4 @@
   test:
     runs-on: ubuntu-24.04
+    if: github.event_name == 'pull_request'
     steps:

@@ -25,0 +44,4 @@
+          REPO=${{ github.repository }}
+          API="${{ github.server_url }}/api/v1"
+          if [ "${GITHUB_EVENT_NAME}" = "issue_comment" ]; then
+            PR=${{ github.event.issue.number }}

@@ -0,0 +17,4 @@
+          python3 - <<'PY'
+import sys, yaml, re
+from pathlib import Path
+p = Path('.gitea/workflows/ci.yml')

@@ -24,1 +29,3 @@
-  # Removed gpt-4.1, gpt-5-mini, gpt-4.1-mini - not deployed on AI Core
+  review-gate:
+    runs-on: ubuntu-24.04
+    if: github.event_name == 'pull_request' || (github.event_name == 'issue_comment' && github.event.issue.pull_request)

@@ -25,0 +40,4 @@
+        env:
+          GITEA_TOKEN: ${{ secrets.RODIN_TOKEN }}
+        run: |
+          set -e

@@ -25,0 +49,4 @@
+            PR=${{ github.event.pull_request.number }}
+          fi
+          # Get head SHA from PR JSON (works for both events)
+          PR_JSON=$(curl -sS -H "Authorization: token $GITEA_TOKEN" "$API/repos/$REPO/pulls/$PR")

@@ -25,0 +57,4 @@
+          AGE_MIN=$(( (NOW - PR_TS) / 60 ))
+          TTL_MIN=${SELF_REVIEW_TTL_MIN}
+
+          COMMENTS=$(curl -sS -H "Authorization: token $GITEA_TOKEN" "$API/repos/$REPO/issues/$PR/comments?limit=200")

@@ -23,2 +29,2 @@
-  # Available models: gpt-5, anthropic--claude-4.6-sonnet, anthropic--claude-4.6-opus
-  # Removed gpt-4.1, gpt-5-mini, gpt-4.1-mini - not deployed on AI Core
+  review-gate:
+    runs-on: ubuntu-24.04

@@ -25,0 +48,4 @@
+          else
+            PR=${{ github.event.pull_request.number }}
+          fi
+          # Get head SHA from PR JSON (works for both events)

@@ -25,0 +63,4 @@
+          if [ "$HAS_SR" -gt 0 ]; then
+            ALLOW=true
+            REASON=self-review
+          elif [ "$AGE_MIN" -ge "$TTL_MIN" ]; then

@@ -25,0 +71,4 @@
+            REASON=missing
+          fi
+
+          echo "allow_review=$ALLOW" >> $GITHUB_OUTPUT

@@ -25,0 +73,4 @@
+
+          echo "allow_review=$ALLOW" >> $GITHUB_OUTPUT
+          echo "reason=$REASON" >> $GITHUB_OUTPUT
+

@@ -29,3 +80,4 @@
+    needs: [review-gate]
     strategy:
       matrix:
         include:

@@ -0,0 +15,4 @@
+        run: |
+          set -euo pipefail
+          python3 - <<'PY'
+import sys, yaml, re

@@ -18,14 +26,58 @@ jobs:
       - run: go vet ./...
       - run: go build -o review-bot ./cmd/review-bot
 

@@ -9,3 +14,4 @@
 jobs:
   test:
     runs-on: ubuntu-24.04
+    if: github.event_name == 'pull_request'

@@ -11,2 +16,4 @@
     runs-on: ubuntu-24.04
+    if: github.event_name == 'pull_request'
     steps:
+      - name: Install jq

@@ -24,1 +29,3 @@
-  # Removed gpt-4.1, gpt-5-mini, gpt-4.1-mini - not deployed on AI Core
+  review-gate:
+    runs-on: ubuntu-24.04
+    if: github.event_name == 'pull_request' || (github.event_name == 'issue_comment' && github.event.issue.pull_request)

@@ -25,0 +40,4 @@
+        env:
+          GITEA_TOKEN: ${{ secrets.RODIN_TOKEN }}
+        run: |
+          set -e

@@ -25,0 +57,4 @@
+          AGE_MIN=$(( (NOW - PR_TS) / 60 ))
+          TTL_MIN=${SELF_REVIEW_TTL_MIN}
+
+          COMMENTS=$(curl -sS -H "Authorization: token $GITEA_TOKEN" "$API/repos/$REPO/issues/$PR/comments?limit=200")

@@ -25,0 +58,4 @@
+          TTL_MIN=${SELF_REVIEW_TTL_MIN}
+
+          COMMENTS=$(curl -sS -H "Authorization: token $GITEA_TOKEN" "$API/repos/$REPO/issues/$PR/comments?limit=200")
+          HAS_SR=$(echo "$COMMENTS" | jq -r --arg sha "$SHA" '[.[] | select(.user.login=="rodin") | select(.body|contains("Self-review against "+$sha)) | select(.body|test("(?im)^###\\s+Doc consistency\\b"))] | length')

@@ -0,0 +15,4 @@
+        run: |
+          set -euo pipefail
+          python3 - <<'PY'
+import sys, yaml, re

@@ -0,0 +18,4 @@
+import sys, yaml, re
+from pathlib import Path
+p = Path('.gitea/workflows/ci.yml')
+w = yaml.safe_load(p.read_text())