# DEVX-155: Replace pr_review with spec-driven CI gates and pr-review skill

## Problem
The `devx.ci.pr_review` module was a monolithic automated PR review tool that
ran in CI and posted COMMENT/REQUEST_CHANGES reviews. It duplicated logic now
better handled by an agent-invoked skill, and it blocked the introduction of
spec-driven development gates (validate_spec, check_pr_size) that should run
before expensive CI jobs.

## Approach
Remove `pr_review` and replace it with lightweight, focused CI gates plus a
new `pr-review` skill for deep agent-invoked reviews.

REQ-1: Add `devx.ci.validate_spec` — validates spec file exists, has required sections, REQ-IDs, all ACs checked
REQ-2: Add `devx.ci.check_pr_size` — enforces max 500 lines / 10 files (excludes CHANGELOG, badges, locks)
REQ-3: Add `devx.ci.fast_molecule` — detects changed roles, outputs fast molecule commands (converge+verify, single platform)
REQ-4: Add `devx.ci.nightly_gate` — checks/sets NIGHTLY_STATUS repo variable to block staging deploys on nightly failure
REQ-5: Add `devx.ci.create_dependency_pr` — auto-creates infra PR to bump pinned package version after grm/sso-bridge release
REQ-6: Remove `devx.ci.pr_review` module and `tests/unit/test_pr_review.py`
REQ-7: Update CI workflows to replace pr_review steps with validate_spec + check_pr_size + curl-based APPROVE
REQ-8: Add `spec-driven-development` and `pr-review` skills under `.devin/skills/`
REQ-9: Update AGENTS.md and skill docs to document the new spec-driven workflow

## Test Plan
- Unit tests for each new module (test_validate_spec, test_check_pr_size, test_fast_molecule, test_nightly_gate, test_create_dependency_pr, test_spec_driven_workflows)
- Remove test_pr_review.py and pr_review references from test_cli.py (pr_review.py deleted from source)
- Verify CI workflow YAML passes actionlint

## Deploy Plan
- Merge to master via auto-merge workflow
- devx post-merge publishes new version; downstream repos (grm, infra, sso-bridge) bump their devx pin

## Rollback Plan
- Revert the merge commit; downstream repos keep their current devx pin
- pr_review.py can be restored from git history if needed

## Acceptance Criteria
- [x] REQ-1: `devx.ci.validate_spec` module exists with `--branch` and `--github-output` options
- [x] REQ-2: `devx.ci.check_pr_size` module exists with `--base`, `--head`, `--github-output` options
- [x] REQ-3: `devx.ci.fast_molecule` module exists and outputs changed roles + commands
- [x] REQ-4: `devx.ci.nightly_gate` module exists with `--action check/set-passed/set-failed`
- [x] REQ-5: `devx.ci.create_dependency_pr` module exists with `--repo`, `--package`, `--new-version` options
- [x] REQ-6: The pr_review CI module and its test file are deleted from source tree
- [x] REQ-7: CI workflow uses validate_spec + check_pr_size + curl APPROVE instead of pr_review
- [x] REQ-8: `.devin/skills/spec-driven-development/SKILL.md` and `.devin/skills/pr-review/SKILL.md` exist
- [x] REQ-9: AGENTS.md documents spec-driven development workflow and pr-review skill