[polewskm]

Finishes the engine refactor of #95. The remaining GitHub reads (open and closed issues, permission lookups, the training's guidance issues) move onto the shared client in src/github.ts, and outcomes and the publish step's dismissals use the one writer check.
The finding marker is read in one place (the last marker, which fixes outcomes recording the wrong finding when a suggestion holds a marker-like line), and gather and the template check share one git read.
Model-written text in every bot comment goes through neutralizeProse, so it can no longer mention anyone or post links, while code spans and fences stay intact.
config.yml is parsed with the yaml library (failsafe schema, same error shape), and one check covers path items.

Closes #95

[ncode-review]

🤖 NCode Review at 8354232: 1 new finding on the changed lines.

Not on a changed line:

• 🟡 F2 Nit: Taught-rule text still gets mention-only escaping src/teach.ts:56. src/teach.ts still uses neutralizeMentions at lines 47 and 56, so a link in a taught rule or in the 'Review guidance:' line stays live. Is that intended, given the rule is maintainer text and not model text? Fix: Switch src/teach.ts lines 47 and 56 to neutralizeProse. Or, if taught rules are meant to keep links, say in the changelog that they are maintainer text and only mentions are escaped.

[ncode-review]

_{Superseded by the review at 8354232.}

[polewskm]

Autopilot: ready to merge as far as this run can tell. The plan's review caught and fixed two should-fix problems before the push: a lone carriage return reopening a ping, and a flow-mapping root parsing. The bot's review raised one question, which doesn't hold (file paths in code spans never pass through neutralizeProse). This closes #95. Follow-up filed after the merge: neutralize #123 and owner/repo#123 references in model-written text.

[polewskm]

/review

[ncode-review]

🤖 NCode Review at 8354232: 2 new findings on the changed lines.

[ncode-review]

🤖 Review complete

Verdict: 💬 Comment — This finishes the #95 refactor. The remaining GitHub reads move onto the shared client in src/github.ts, and the three permission checks become one writerCheck. The finding marker is read in one place, and gather and the template check share one git read through gatherChecked. Model-written comment text goes through neutralizeProse, and config.yml is parsed with the yaml library. The design holds together: it removes duplication rather than adding workarounds, and new tests cover each changed path. The remaining points are about disclosure in the changelog and description, not about how the code behaves.

8 reviewers run — 2 findings (run details)

Reviewer	Model	Findings	Top
synthesis	opus-5-5	2	🟡
architecture	sonnet-5-5	0	🟢
completeness	sonnet-5-5	0	🟢
conventions	sonnet-5-5	0	🟢
correctness	sonnet-5-5	0	🟢
hygiene	haiku-5-5	0	🟢
intent	haiku-5-5	2	🟠
rule-check	sonnet-5-5	0	🟢
security	sonnet-5-5	0	🟢

Skipped: api-compat, data-model, infrastructure, performance, tests

Findings

• 🟡 F1 src/writers.ts:21: Is counting role_name: maintain as a writer in every check intended, and worth saying?
• 🟡 F2 CHANGELOG.md:35: Changelog says the YAML subset is unchanged, but indented keys now read

_{Trial: findings are posted as review threads and in the check run. $0.91 on Amazon Bedrock, 82s, at 8354232. (how to interact)}

📋 Outcomes

Merged at 8354232: 0 fixed, 3 dismissed, 0 acknowledged, 0 ignored.

Finding	Reviewer	Severity	Outcome
F1	correctness	🟡 Nit	👎 dismissed
F1	intent	🟡 Nit	👎 dismissed
F2	intent	🟡 Nit	👎 dismissed

[polewskm]

On the src/teach.ts finding in the review at 8354232 (taught-rule text still escapes only mentions): not changed.

• Line 47 (fenced) quotes the text in a fenced code block, where links never render.
• Line 56 (issueTitle) builds an issue title, which GitHub shows as plain text.
• The rule is a writer's own text, not model text, and the training reader strips the zero-width space neutralizeMentions adds.

neutralizeProse would add nothing here.