# Show HN: Review-to-rule – Turn accepted review feedback into durable repo rules

> Source: <https://github.com/vamgan/review-to-rule>
> Published: 2026-09-03 03:46:08+00:00

**A reviewer catches it once. Every future review remembers.**

`review-to-rule`

turns accepted code-review feedback into durable, scoped
repository memory—whether the review came from GitHub, GitLab, Bitbucket,
Gerrit, Azure Repos, or a private system your coding agent can access.

Run these commands inside Claude Code:

```
/plugin marketplace add vamgan/review-to-rule
/plugin install review-to-rule@review-to-rule
/reload-plugins
```

Then invoke it directly:

```
/review-to-rule:review-to-rule-write Turn this accepted review into a rule: <PR, MR, change, or comment URL>
npx skills add vamgan/review-to-rule \
  --skill review-to-rule-write \
  --agent codex \
  --yes
```

Then ask:

Turn this accepted review into a rule:

`<PR, MR, change, or comment URL>`

That is the whole agent installation. No separate `review-to-rule`

CLI, npm
package install, `gh auth login`

, model API key, or provider configuration is
needed. The plugin and portable skill both include the deterministic helper
used for previews, writes, and validation. Runtime requirements are Node.js 24+
and Git.

The skill retrieves the accepted review and its before/after revisions, creates
a temporary provider-neutral bundle, and shows a complete dry run. Nothing is
saved until you choose `AGENTS.md`

, `CLAUDE.md`

, both, or neither—and approve
the exact write plan.

```
review
  “Use the injected Clock here so retry tests stay deterministic.”

accepted fix
  return clock.now() + retryDelay

stored rule
  scope: src/jobs/*.ts
  flag: direct wall-clock reads when Clock is available
  prefer: clock.now()

future agent review
  “Use clock.now() here.”
php
flowchart LR
  A[Any review system] -->|host agent tools| B[Accepted before + after]
  B --> C[Scoped review rule]
  C --> D[Provenance + integrity checks]
  D --> E[Human-approved write]
  E --> F[.review-to-rule]
  F -->|AGENTS.md / CLAUDE.md pointer| G[Future coding agents]
```

The agent understands the review. The core verifies bounded evidence, accepted before/after examples, scope coverage, credentials, collisions, hashes, index consistency, and the complete write transaction.

Rules can capture correctness, security, architecture, behavior, testing, performance, style, maintainability, and product constraints. Ambiguous, one-off, unsupported, or dangerously broad feedback is refused.

The repository owns its future review memory:

```
.review-to-rule/
├── INDEX.md      # scope-aware directory for agents
├── rules/        # readable Markdown review rules
├── evidence/     # bounded accepted review provenance
└── manifests/    # structured rules, hashes, and approval metadata
```

`.review-to-rule/`

is canonical. Optional managed blocks in `AGENTS.md`

and
`CLAUDE.md`

tell agents to read the index and load only rules matching the files
they are reviewing. Rule logic is never duplicated there.

Integrity validation is local and deterministic. During an agent run, the installed skill uses its bundled helper to validate the complete write and replay its manifest; it does not download or look up another executable.

You do not need this section for Claude Code or Codex. Install or invoke the npm CLI only for terminal automation, CI, or the standalone GitHub adapter:

```
npx review-to-rule@latest validate-all .review-to-rule --repo-dir .
npx review-to-rule@latest replay .review-to-rule/manifests/<rule>.json
```

If you intentionally run without a capable host agent, the standalone adapter can retrieve one GitHub review and call OpenAI or Anthropic itself:

```
gh auth login
export OPENAI_API_KEY=...

npx review-to-rule@latest doctor
npx review-to-rule@latest generate \
  'https://github.com/owner/repo/pull/123#discussion_r456'
```

`gh`

authentication and a model credential are required only for this adapter.
They are not required for `apply`

, `validate`

, `validate-all`

, or `replay`

.

For custom integrations, emit a versioned
[review-memory bundle](/vamgan/review-to-rule/blob/main/docs/REVIEW_BUNDLE.md) and run:

```
npx review-to-rule@latest apply review-bundle.json --repo-dir .
```

- Dry run by default; writes require a reviewed preview and explicit approval.
- Credential-free, bounded bundles; embedded URL credentials are rejected.
- Exactly one scoped, agent-readable rule anchored to the accepted correction.
- Structural, provenance, credential, hash, index, and pointer validation.
- No target builds, tests, hooks, package scripts, or generated commands run.
- Contained, symlink-aware, journaled writes with rollback and replay hashes.
- Change-request publication is a separate opt-in and never auto-merges.

There is no account, daemon, telemetry, or background learner. See the full
[architecture](/vamgan/review-to-rule/blob/main/docs/ARCHITECTURE.md) and [security model](/vamgan/review-to-rule/blob/main/docs/SECURITY.md).

```
npm ci
npm run release:check
```

Contributions are welcome—start with [CONTRIBUTING.md](/vamgan/review-to-rule/blob/main/CONTRIBUTING.md).

MIT licensed.