feat: improve AI reviewer assumption handling to reduce spam

[LearningCircuit]

Summary

• Prevents AI from spamming users with questions about unverifiable issues
• Makes "skip" the default behavior when context is missing from the diff
• Only allows clarification questions for critical issues (security, breaking bugs, data loss)
• Requires explicit labeling of inferences as "Inference (not verified)"

Changes

Updated the AI reviewer prompt in ai-reviewer.sh to handle assumptions more carefully:

• Default behavior: Skip issues that can't be verified from the diff
• Critical issues only: Ask for clarification only for security vulnerabilities, breaking bugs, or data loss risks
• Non-critical inferences: Must be explicitly labeled as "Inference (not verified)"
• Focus on visible code: Emphasizes reviewing only what's directly in the diff

Test plan

• Test with a PR that has missing context (e.g., configuration not in diff)
• Verify AI doesn't ask questions about non-critical missing context
• Verify AI does ask about critical issues when context is missing
• Verify inferences are properly labeled when made

[github-actions]

AI Code Review

❌ Error: AI returned empty response

---

Review by Friendly AI Reviewer - made with ❤️

[github-actions]

AI Code Review

❌ Error: AI returned empty response

---

Review by Friendly AI Reviewer - made with ❤️

[github-actions]

AI Code Review

🔴 Critical Issues

Security Vulnerability - Debug Logging Exposes Sensitive Data

• .github/workflows/ai-code-reviewer.yml: Unconditional debug output (echo "$AI_RESPONSE") prints raw AI responses containing full code diffs and potentially API keys/tokens to CI logs
• ai-reviewer.sh: Debug block dumps full API response to stderr when CONTENT is empty, exposing sensitive data in GitHub Actions logs
• Risk: CI logs may be accessible to unauthorized users or leaked in public repositories; could violate security best practices for secret handling
• Recommendation: Remove debug code or guard behind strict DEBUG_MODE flag that defaults to false

Cannot Verify from Diff - Please Confirm

• Debug code is marked "temporarily" in comments but no removal plan is visible. Will this be removed before merge? Merging debug logging to main would create persistent security risk.

🟡 High-Value Improvements

Prompt Enhancement (Excellent)

• New instructions effectively reduce spam by:
  • Defaulting to skip unverifiable issues
  • Restricting clarification questions to critical issues only (security, breaking bugs, data loss)
  • Requiring explicit "Inference (not verified)" labeling
  • Emphasizing focus on diff-visible code
• Clear, actionable guidance that should significantly improve review quality

🟢 Code Quality Notes

Best Practices

• Debug code should use conditional flags (if [ "$DEBUG_MODE" = "true" ]) rather than hardcoded output
• Consider adding TODO: comments for temporary debug code to prevent accidental permanent merges
• Prompt structure is well-organized with clear bullet points and hierarchy

Performance

• No performance impact from changes; debug logging is I/O negligible

---

Review by Friendly AI Reviewer - made with ❤️

[github-actions]

AI Code Review

Overall Feedback: The prompt improvements effectively address spam concerns by establishing clear rules for handling missing context and enforcing structured review output. The changes are well-structured and should significantly improve review quality.

Detailed Findings:

• ✅ Prompt Clarity: New instructions explicitly define when to skip issues, when to ask for clarification, and how to label inferences, which directly addresses the PR's spam reduction goal
• ✅ Structured Output: Requiring a short summary, detailed findings, and explicit verdict creates consistent, actionable reviews
• ✅ Verdict Enforcement: Adding instruction Update README.md #4 ensures reviewers will always provide clear approval status
• ✅ Bash Syntax: Proper escaping of internal quotes maintains script integrity
• ✅ Focus on High-Value Issues: Emphasis on "critical issues only" for clarification questions aligns with best practices

✅ Approved

---

Review by Friendly AI Reviewer - made with ❤️