[HackTuah]

What

docs/CODE_REVIEW.md: how a pull request is reviewed and what it needs before it merges. This is for OpenSSF gold code_review_standards (Met with this PR).

• How: CI's required checks pass first, then a reviewer who isn't the author reads the whole diff and approves or requests changes line by line, and every review thread is resolved (the ruleset enforces this) before a merge commit.
• Honest about today: while there are few maintainers, the lead may merge their own change after CI. The aim is a second person's review on every change.
• What the reviewer checks:
  • it does what it says and matches its spec;
  • tests, with a regression test for each fix, and the coverage gates;
  • trust boundaries, input validation, no HTML from data, the privacy inventory and the assurance case;
  • dependencies within the license rule and the dependency policy;
  • no English or single-language assumptions, accessibility, and the popup budgets;
  • docs, the CHANGELOG and the DCO.
• Standard of evidence: every claim carries a failing test or a command with its output.
• Agent changes are reviewed the same way, and the lead agent re-verifies before opening a PR.

CONTRIBUTING.md now links it.

Checked

bestpractices-links --check (209 valid), check-old-name, check-base-neutral. Every path the document names exists.

🤖 Generated with Claude Code