Risk Classifier

A deterministic 0–100 score over a PR diff. Same inputs in → same score out, every time, on every SHA. The classifier is the data layer of the auto-merge bet (bb682faa); without a stable score there is nothing for the approver to gate on.

When to invoke

• A pull_request event arrives with action opened, synchronize, reopened, or ready_for_review against main.
• The orchestrate-pr-review skill asks for the score for a specific commit SHA.
• A human asks "what would the classifier score this?" on an open PR.

The skill re-runs on every synchronize (per-SHA). The previous verdict is invalidated as soon as the head SHA moves; never carry forward.

Do NOT invoke

• After a merge has already happened — the score has no consumer.
• For PRs targeting branches other than main — branch protection only enforces the gate on main.
• As a substitute for review-checklist (correctness, tests, naming) or security-review (OWASP/STRIDE). The classifier is triage, not review.
• To "improve" the diff. The score is read-only output; do not edit code, propose fixes, or comment lines.

Method

Walk these in order. Each step is non-negotiable; skipping any step makes the verdict non-deterministic.

1. Resolve the diff

Run the adapter binary at packages/risk-classifier/bin/risk-classifier.mjs. Pass:

• --base = PR base SHA (the merge target's head at PR-open time)
• --head = PR head SHA from the webhook payload
• --repo = path to the checkout
• --cve-dep <name@version> for each newly-introduced dependency that already has a CVE
• --missing-tests if the diff includes logic-bearing files but no test changes
• --ai-generated if the PR body or commit trailers carry an AI-authoring marker
• --public-api-delta <n> for the count of public symbols added/removed
• --incident-density <file.json> if Sentry/PagerDuty data is available

The adapter reads .maskin/protected-paths.yml, .maskin/risk-floors.yml, and .maskin/hot-tables.yml from the repo, runs git diff between the two SHAs, runs squawk on .sql files, and runs Semgrep diff-scan. It returns a ClassifierVerdict JSON object.

2. Apply the signal table

Sum the weights of every triggered signal. Cap the sum at 100.

3. Apply the floors

Floors override the additive sum. Apply in this order:

• Protected path — any file matches a glob in .maskin/protected-paths.yml → score = 100, regardless of additive sum.
• Regex floor — any line matches a pattern in .maskin/risk-floors.yml → score = max(additive_sum, 80).
• Squawk hot-table hit — squawk flags a blocking lock against a table in .maskin/hot-tables.yml → score = max(additive_sum, 80).

The additive sum and the floors are independent computations; the final score is the maximum of all of them, capped at 100.

Verdict

Exactly one band. Not a range, not "around 30," not "depends." Pick.

• AUTO-APPROVE ELIGIBLE — score < 25. The PR is eligible for orchestrate-pr-review to consume; it does not auto-approve here.
• AGENT RECOMMENDS HUMAN — 25 ≤ score < 80. Orchestrator runs perspectives but never submits APPROVE.
• HUMAN REVIEW REQUIRED — score ≥ 80. Orchestrator stops and routes to humans.

Output

Write the verdict on the task linked from the PR's github_link, under a ## Risk Score heading, with this structure:

## Risk Score

**Score:** <0-100>/100 — <BAND LABEL>
**Skill version:** 0.1.0
**Commit:** <head-sha>
**Deterministic seed:** <16-hex>

### Signals
- `paths_auth_session` +15 — packages/auth/src/session.ts
- `diff_loc` +12 — 240 lines changed across 3 files

### Floors applied
- `protected_path` — packages/auth/** matches packages/auth/src/session.ts

Also post the maskin/risk-score GitHub check run with conclusion:

• success for AUTO-APPROVE ELIGIBLE
• neutral for AGENT RECOMMENDS HUMAN
• failure for HUMAN REVIEW REQUIRED

The check-run summary includes the score and band; the full block goes on the task, not on the PR (the PR is a projection of the task).

Attestation

Record the skill version (0.1.0) and the deterministic seed in the in-toto attestation built by orchestrate-pr-review. The orchestrator binds the version to the verdict; bumping version: in this skill's frontmatter must accompany any change to the signal table, weights, floors, or output format.

What NOT to do

• Do not invent a signal that isn't in the table. The table is the contract; new signals require a version bump and a bet revision.
• Do not produce a non-deterministic score. If the adapter cannot reach a sub-tool (squawk, semgrep, incident density), the affected signal is absent, not guessed. Absent signals are observable in the verdict — that is itself a feature.
• Do not write a partial verdict. Either the full ## Risk Score block lands on the task and the check run lands on the PR, or neither does. Half-output is worse than no output.
• Do not edit .maskin/protected-paths.yml, .maskin/risk-floors.yml, or .maskin/hot-tables.yml from this skill. Those are protected paths themselves; edits are always human-review PRs.
• Do not approve, merge, or request changes. Score, output, stop. The downstream skills decide what happens next.