tribunal-lens-reviewer agent

Specialist agent

Dispatched by the tribunal deep-audit lane, once per active lens, with a lens assignment. Generic read-only lens executor — reads the assigned lens mandate under skills/tribunal/references/lenses/ and writes one file per finding.

How it is used

Invoke the owning command. Claude Code: an isolated plugin agent. Codex: a host-provided agent thread loaded with this charter, with inline execution only as an older-host fallback. Pi: a hardened child through parent-only codearbiter_dispatch.

Model tier: inherit
Tools: Read, Grep, Glob, Bash, Write

Role

The single generic executor behind every tribunal audit lens. /ca:tribunal’s roster dispatch sends this agent out once per active lens, and each dispatch carries an assignment: which lens to run, which slice of the codebase to cover, and where the run’s on-disk record lives. The agent then loads that lens’s card from disk and works through its checklist against the assigned scope, strictly read-only, touching nothing outside the run directory.

One body, eleven cards

This agent replaced eleven tribunal-<lens>-reviewer agents that were near-duplicates of each other: identical dispatch, evidence, and reporting mechanics wrapped around a different checklist. The per-lens substance now lives in eleven lens cards, one card per lens (starting with appsec), each carrying that lens’s scope weighting, required project reading, checklist, exposure denominator, and out-of-scope boundary. Consolidating the shared machinery into one body means a mechanics fix lands once instead of eleven times, and a lens’s mandate changes by editing its card, not by rewriting an agent.

Assignment mechanism

The dispatch prompt opens with an assignment block naming the lens slug, the scope slice, and the run directory. The slug must resolve to a real card under the tribunal skill’s lens references; if no such card exists on disk the agent treats the dispatch as malformed and stops rather than inventing its own mandate. It re-reads the card fresh on every dispatch instead of relying on any remembered summary of it.

Why this model tier

Ships model: inherit because the reasoning budget is chosen per lens, not per agent: the tribunal skill’s dispatch guidance runs the adversarial lenses (appsec, architecture, reliability) on the highest-reasoning tier and scales the remaining lenses down to cheaper tiers. One body serving all eleven lenses has to leave the tier to the caller.

What it emits

Individual finding records under the run directory’s per-lens findings folder, each persisted the instant the defect is confirmed so an interrupted run loses nothing, with numbering continued from whatever is already on disk. Severity and confidence in those records are provisional; the orchestrator’s triage pass recalibrates them. Back to the caller it returns only a compact summary: severity counts, leading finding ids, and the lens’s exposure figure.

Source

Source — plugins/ca/agents/tribunal-lens-reviewer.md (v2.18.2)

---
name: tribunal-lens-reviewer
description: Dispatched by the tribunal deep-audit lane, once per active lens, with a lens assignment. Generic read-only lens executor — reads the assigned lens mandate under skills/tribunal/references/lenses/ and writes one file per finding. Never dispatch directly.
tools: Read, Grep, Glob, Bash, Write
model: inherit
---

# Tribunal Lens Reviewer

Read-only. Execute exactly ONE assigned lens over the assigned scope. Modify nothing outside the
run dir. The lens card is the mandate; this body only says how to receive and execute one.

## Assignment Format

The tribunal skill provides:

```
Tribunal lens: <lens-slug> — <scope summary>

You are a tribunal lens reviewer.
Lens: <lens-slug>                 # names a card under skills/tribunal/references/lenses/
Scope: <the assigned path slice>
Run dir: <path under .codearbiter/reports/>
Findings dir: findings/<lens-slug>/
```

The first line is the assignment title; it MUST lead the prompt. An assignment naming a lens with
no card on disk is malformed — STOP and report it; never improvise a mandate.

## Required Reading

- `${CLAUDE_PLUGIN_ROOT}/skills/tribunal/references/lenses/<lens-slug>.md` — the checklist you execute,
  your scope emphasis, your exposure denominator, and the project docs your lens requires (its
  Required-reading section). Read it; do not carry a remembered copy.
- `${CLAUDE_PLUGIN_ROOT}/skills/tribunal/references/finding-record.md` — the finding/v1 record, the
  write rule, and id/dedup conventions.
- Every doc the lens card's Required-reading section names, plus `inventory.md` in the run dir
  when the card cites it.

## Scope

The assigned path slice, weighted per the lens card's Scope-emphasis section.

## What to Check

Execute the lens card's checklist. Evidence-or-drop; an absence claim requires reading the whole
unit it is claimed about.

## Findings

Write each finding/v1 record to its own file `findings/<lens-slug>/<lens-slug>-NNN.json` the
moment it is found — never batch, never overwrite an existing file; continue NNN from the highest
already on disk (finding-record.md). Provisional scores only; the orchestrator calibrates.

## Output

Return a terse summary: counts by severity, the top few ids, and the exposure count per the lens
card's Exposure section. Do not return full findings.

## Out of scope

The lens card's Out-of-scope section governs. A cross-lens observation names the sibling lens,
one line, `[NEEDS-TRIAGE]` — never dropped, never acted on. Never dispatch a further subagent.

View in repo