feat(code-reviews): support REVIEW.md

[alex-alecu]

Summary

• Add support for repository-level REVIEW.md guidance in code review prompts and record when that guidance is used.
• Keep REVIEW.md disabled by default through the DB-backed disable_review_md setting so the feature can be enabled selectively during testing.
• Preserve the settings UI/API toggle so explicit disable_review_md: false enables repository guidance.

Verification

N/A - no manual verification was performed for this backend default change.

Visual Changes

N/A

Reviewer Notes

The default-off behavior is intended as a short-lived rollout flag. Existing configs with disable_review_md missing now skip repository REVIEW.md; explicitly setting it to false enables the feature.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Incremental Review

Reviewed changes since commit 49f287bb (last review). The new commit (21046c77) and two merge-from-main commits (fbd56bc8, 580f6369) are the incremental delta.

Changes reviewed in incremental diff:

• prepare-review-payload.ts — shouldUseReviewMd logic changed from !== true to === false (REVIEW.md is now opt-in; undefined defaults to off). Correct.
• code-reviews-router.ts — disableReviewMd defaults updated to true in get/save paths. Consistent with the intent.
• organization-code-reviews-router.ts — Same default change as personal router. Consistent.
• prepare-review-payload.test.ts — baseAgentConfig now explicitly sets disable_review_md: false so existing REVIEW.md tests remain valid; the "skips lookup" test correctly switches to undefined to exercise the new default-off path. Test renames accurately reflect the semantic change.

All previous resolutions confirmed still in place. No new issues found.

Files Reviewed (23 files)

• apps/web/src/app/api/internal/code-review-status/[reviewId]/route.ts
• apps/web/src/app/api/internal/code-review-status/[reviewId]/route.test.ts
• apps/web/src/components/code-reviews/ReviewConfigForm.tsx
• apps/web/src/lib/code-reviews/db/code-reviews.ts
• apps/web/src/lib/code-reviews/prompts/generate-prompt.ts
• apps/web/src/lib/code-reviews/prompts/generate-prompt.test.ts
• apps/web/src/lib/code-reviews/prompts/repository-review-instructions.ts — previous suggestion resolved
• apps/web/src/lib/code-reviews/summary/usage-footer.ts
• apps/web/src/lib/code-reviews/summary/usage-footer.test.ts
• apps/web/src/lib/code-reviews/triggers/prepare-review-payload.ts ✓ (incremental)
• apps/web/src/lib/code-reviews/triggers/prepare-review-payload.test.ts ✓ (incremental)
• apps/web/src/lib/integrations/platforms/github/adapter.ts
• apps/web/src/lib/integrations/platforms/github/fetch-root-text-file-at-ref.test.ts
• apps/web/src/lib/integrations/platforms/github/webhook-handlers/pull-request-checkout-ref.ts
• apps/web/src/lib/integrations/platforms/gitlab/adapter.test.ts
• apps/web/src/lib/integrations/platforms/gitlab/adapter.ts
• apps/web/src/routers/code-reviews-router.ts ✓ (incremental)
• apps/web/src/routers/code-reviews/code-reviews-router.ts
• apps/web/src/routers/organizations/organization-code-reviews-router.ts ✓ (incremental)
• apps/web/src/tests/setup/__mocks__/lib/integrations/platforms/github/adapter.ts
• packages/db/src/migrations/0124_fat_robbie_robertson.sql
• packages/db/src/schema.ts
• packages/db/src/schema-types.ts

---

_{Reviewed by claude-sonnet-4.6 · 3,275,668 tokens}

[alex-alecu]

Manual test passed.

Tested:

• Dev-only code review payload preparation flow for a seeded GitHub review row with REVIEW.md disabled/default-off.
• Prompt generation path reached prepareReviewPayload and generated a GitHub review payload without repository REVIEW.md guidance.

Verified:

• REVIEW.md metadata columns exist on cloud_agent_code_reviews.
• Persisted metadata remained repository_review_instructions_used=false, repository_review_instructions_ref=null, repository_review_instructions_truncated=false.
• Generated prompt used default review guidance and did not include the REVIEW.md instructions section.

[jrf0110]

nit; It's just a little bit wonky that the field name is for controlling this feature is phrased as the negative (i.e. disable review.md?) rather than the positive review_md_enabled. Might consider adding a default value to the zod schema as well so undefined's don't need to be considered

[alex-alecu]

I'll address it in a followup PR prob next in which I enable by default REVIEW.md for all orgs

Orgs still need to add the REVIEW.md file