ci: unblock AI-authored PRs (review gate + mention context)

.github/workflows/claude-mention.yml

@@ -83,11 +83,43 @@ jobs:
             --model claude-sonnet-4-6
             --max-turns 48
             --allowedTools "Read,Write,Edit,Grep,Glob,mcp__github_inline_comment__create_inline_comment,Bash(gh pr view:*),Bash(gh pr diff:*),Bash(gh pr comment:*),Bash(gh pr checkout:*),Bash(gh pr create:*),Bash(gh issue view:*),Bash(gh issue comment:*),Bash(git:*),Bash(npm install:*),Bash(npm ci:*),Bash(npm run:*),Bash(npm test:*),Bash(bun install:*),Bash(bun run:*),Bash(bun test:*),Bash(npx:*)"
-          # In agent mode the action uses the triggering comment as the
-          # prompt. The text below layers supplemental context on top.
+          # In agent mode the action can use the triggering comment as the
+          # prompt, but we inline it explicitly below to guarantee the agent
+          # always has PR/issue number, URL, and the commenter's exact
+          # request — without these, the agent has been observed to respond
+          # "I don't see a specific task in this mention, could you share
+          # the PR number?" which defeats the whole point of the workflow.
+          #
+          # TODO: revisit if a future claude-code-action release reliably
+          # forwards the triggering comment as the prompt. This inline
+          # injection can then collapse back to supplemental context.
           prompt: |
             You were invoked via an `@claude` mention on ${{ github.repository }}.
 
+            ## Mention context
+
+            - Repo: ${{ github.repository }}
+            - Target number: #${{ github.event.issue.number || github.event.pull_request.number }}
+            - Target URL: ${{ github.event.issue.html_url || github.event.pull_request.html_url }}
+            - Target kind: ${{ github.event.issue.pull_request && 'pull request' || (github.event.pull_request && 'pull request' || 'issue') }}
+            - Commenter: @${{ github.event.comment.user.login }}
+
+            The commenter wrote (verbatim, including any multi-line content):
+
+            ```
+            ${{ github.event.comment.body }}
+            ```
+
+            Start by reading the target so you have real context:
+            - For a PR: `gh pr view <N>` then `gh pr diff <N>` if you need
+              the changes.
+            - For an issue: `gh issue view <N>`.
+
+            Then act on the request. If the request is "review this PR",
+            post the review as a single `gh pr comment` following the
+            review discipline in `.github/review-scopes/universal.md` (in
+            this repo) — do NOT treat review as a code-edit task.
+
             ## Conventions
 
             Read `CLAUDE.md` in the repo root first. Its "Code Conventions"

.github/workflows/claude-review.yml

@@ -10,12 +10,15 @@ concurrency:
 
 jobs:
   review:
-    # Only review PRs authored by HarperFast org members / collaborators.
-    # External PRs are not auto-reviewed — a maintainer can opt one in later
-    # via an @claude mention (handled by a separate workflow).
+    # Review PRs authored by HarperFast org members / collaborators AND
+    # PRs opened by our own issue-to-PR bot (claude[bot]) — AI-authored PRs
+    # need review MOST, not least. External human PRs are not auto-reviewed;
+    # a maintainer can opt one in via an `@claude` mention (handled by a
+    # separate workflow).
     if: >-
       contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'),
       github.event.pull_request.author_association)
+      || github.event.pull_request.user.login == 'claude[bot]'
     runs-on: ubuntu-latest
     # Bumped from 10 to 15. We've observed the Claude review step stall on a
     # single long-running API call inside the 10-min window on substantial