@@ -4,7 +4,7 @@ Paste one brief to one reviewer. A brief is the whole assignment: the reviewer h
 
 Generated files (`protopb/`, `mock/`, `*_mock.go`, `*.pb.go`, `*.pb.yarpc.go`) are not reviewed line by line. Say only whether they look stale relative to their source.
 
-Report a finding only when the changed code creates a reachable material impact. For each item give severity (`blocker`, `should-fix`, or `nit` when requested), confidence (`high`, `medium`, or `low`), changed `path:line`, observable impact, the shortest reproducing scenario or static caller trace, supporting locations, the smallest safe fix in this change, and a specific verification step. Cite the `AGENTS.md` section when it explains the engineering constraint, but a rule violation without behavioral, contract, verification, or maintenance impact is a nit and is omitted unless requested.
+Report a finding only when the changed code creates a reachable material impact. Added surface counts as material: a package, interface, adapter, file, dependency, workflow, or call the stated intent does not need is a should-fix, because it is code every later change has to carry and the first thing a human reviewer asks about. Say what breaks if it is deleted; if nothing does, the fix is to delete it. For each item give severity (`blocker`, `should-fix`, or `nit` when requested), confidence (`high`, `medium`, or `low`), changed `path:line`, observable impact, the shortest reproducing scenario or static caller trace, supporting locations, the smallest safe fix in this change, and a specific verification step. Cite the `AGENTS.md` section when it explains the engineering constraint, but a rule violation without behavioral, contract, verification, or maintenance impact is a nit and is omitted unless requested.
 
 When impact or reachability cannot be established, report a question with the exact missing fact. A material question makes review coverage incomplete. Inspect the surrounding implementation and tests needed to support the claim; the changed line alone is not evidence of a system-level defect. Do not restate a mechanical failure (formatting, gazelle, mocks, lint, or a failed test). If nothing is wrong, answer `No findings`.
 
@@ -21,6 +21,13 @@ Covers Design and Separation of Concern. Read `AGENTS.md` on versioned state, co
 - A decision or action extension takes the thin reference entity (`entity.Request`, `entity.Batch`) and resolves changes, diffs, and targets itself. `conflict.Analyzer` is the reference shape.
 - Factories and per-queue routing live in service wiring. `NewFactory` under an `extension/` package violates that ownership when it couples the extension to topology or implementation selection. A service-scoped aggregate, implementation, mocks, and schema live with the service that resolves them; the behavioral contracts stay shared.
 - `platform/` does not import a domain. A domain `core/` does not import a service package. An implementation lives in a subpackage of its interface.
+- Built for consumers in scope. A shared package, an extension point, an adapter, or a second supported path (a fallback format, a host that "can't" do the standard thing) that exists for a consumer the change does not ship is speculative. Extraction waits for the second real consumer.
+- A homegrown wrapper over an ecosystem type (a `Logger` interface in front of zap or pino) where the repository never swaps the implementation.
+- Host and framework details stay in the host; the library owns the complete behaviour. In web code, a framework (Next.js), generated-binding, or transport import under `web/platform/` or the domain module is a finding, and so is product layout, styling, or page assembly in the host. The module depends on the structural shape of the gateway client; only the host picks implementations.
+- A new or moved boundary is enforced by Bazel `visibility` or a forbidden-import test, not only stated in a README or RFC. Generated bindings with several in-repo consumers stay with the contract, private to those consumers.
+- Layout mirrors the Go tree in every language: wiring under `service/`, tests under `test/e2e` and `test/integration`, tooling under `tool/`. A framework default (`web/e2e`) or a package named `platform` that is really one host's wiring is a finding.
+- Identifiers are opaque. Re-encoding an ID for a URL or UI (base64, hashes), or packing auxiliary data into one (file lists in a change URI), is a finding. The path follows the ID's scope (`/<queue>/request/<id>`) or mirrors the URI it names. Timestamps or a fixed window in a page URL, so refresh does not show live data, are a finding; an older page is an opaque cursor.
+- Public-repository hygiene. Confirm every `internal-reference` smell: an Uber-internal system, host, repository, library, or service name in code, tests, or docs is should-fix. Describing an internal consumer by its properties is fine.
 
 Trace both sides of a boundary before reporting it: producer and consumer for queue contracts, caller and implementation for interfaces, controller and store for versioned writes. State the concrete coupling, backend incompatibility, race, or rollout failure the boundary violation creates.
 
@@ -32,7 +39,7 @@ Covers Correctness and Bugs. Read `AGENTS.md` on eventual consistency, idempoten
 - Extensions return plain errors. A classifier decides retry. A failed publish is not wrapped as retryable just so the handler runs again. `storage.ErrNotFound` is a user error only at a call site that knows the user asked for a missing resource.
 - Races, lost updates, a wrong version guard, and a publish that can run before its write. Give the concrete interleaving. Context cancellation is material only when the call can block or leak work after cancellation.
 - A concrete defect in the changed lines: nil or empty identity, a mishandled `""` enum sentinel, an off-by-one, an error that is dropped. A design disagreement is not a bug.
-- Rolling compatibility. Proto field numbers stay stable and evolution stays additive. For schema or message findings, name the incompatible old/new binary combination and deployment order; do not infer a rollout failure from `NOT NULL` alone.
+- Rolling compatibility. Proto field numbers stay stable and evolution stays additive. For schema or message findings, name the incompatible old/new binary combination and deployment order; do not infer a rollout failure from `NOT NULL` alone. Deployments run from this repository (local, demo, CI) hold no data worth migrating, so do not raise a backfill of existing rows for them. When a change alters a persisted format, ask one question about downstream deployments that consume this repository instead of reporting a finding.
 
 ## Simplicity and clarity
 
@@ -43,6 +50,8 @@ Covers Simplicity. Read `AGENTS.md` on naming, comments, and code style.
 - A false comment that changes a reader's understanding of behavior is should-fix. Narration and comment-budget violations are nits. Prefer a clearer name over a comment.
 - Value types. `(T, bool)` for absence, not a pointer. An error is a failure, not a branch of normal control flow.
 - Dead code that expands the maintenance or behavior surface. Treat an intent mismatch as a question unless it creates review risk or changes behavior outside the stated scope.
+- Work the behavior does not need: an upfront pass over every item when each item is checked before it is used, an RPC whose result does not reach the output, a config file that restates defaults, a shell function or wrapper the program could absorb as a flag. Each adds a failure mode for nothing.
+- Names describe what a thing is, not a metaphor: `githubtestrepo` and `SQ_GITHUB_TEST_REPO`, not `sandbox`.
 
 ## Tests and hermeticness
 
@@ -53,6 +62,8 @@ Covers Testing and Hermeticness. Read `AGENTS.md` on testing and `doc/howto/TEST
 - No `assert` or `require` on `err.Error()`. No `time.Sleep`. No timeout of the test's own.
 - Integration and e2e inputs come from runfiles: `testutil.Runfile`, `testutil.WithBuildContext`, and Bazel `data`. Resolving the repo root (`show-toplevel`, `FindRepoRoot`) is a finding. A compose context is `{category}-{domain}-{name}`. Docker or network access has the `integration` and `requires-network` tags.
 - Repository automation and validation run through Bazel with pinned toolchains and declared `srcs`/`data`; Make targets are thin entry points, not a second build graph. Report host-installed tools, undeclared files, runtime downloads, or direct source-tree assumptions when they make local, CI, or remote execution diverge.
+- A new language or tool is built by Bazel end to end. A side-car `go.mod`, a virtualenv, or a package-manager-only build next to the Bazel graph is a finding. A local server binds a free port the way the Compose services do, not a hard-coded one.
+- CI work is a job in `.github/workflows/ci.yml`, not a new workflow or a nightly schedule; confirm every `new-workflow` smell. A test that needs a credential reads a repository secret plus a repository variable naming its target, never a GitHub environment (which records deployments) or a hard-coded repository. It skips only when the repository has not opted in and fails when it has opted in but the credential is missing, so a deleted or expired secret cannot turn CI silently green.
 - Nontrivial scripting is a Python `py_binary`/`py_test` or a Go binary like the repository linters, not Bash. A shell file is limited to an unavoidable `exec`-style launcher with no parsing, branching workflow, or domain logic. For a finding, identify the portability, quoting, dependency, or hermetic-execution failure and name the Python or Go target that should own the logic.
 
 ## Operability
@@ -70,6 +81,8 @@ Run only when documentation changed. Read `AGENTS.md` on README files and markdo
 
 - A decision names material alternatives and why one was chosen when that context is needed to evaluate or safely change it. Missing alternatives are otherwise a question or nit.
 - Terms match the code. A doc that still says `merging` where the code says `landing` is a finding.
+- An RFC reflects main. A finding is any of: "proposed" or "before/after" wording for behavior that has shipped; a standalone discussion or superseded RFC kept next to the RFC that owns the topic; or a description that contradicts the code it names. The fix is to fold the decision into the owning RFC, update references, and delete the rest.
+- Concise. A UX section is a mock image and a one-line description. A section that restates the code, or that a reader has to scroll through to reach the decision, is a finding with the cut named.
 - A README describes behavior in prose. It does not paste an interface or a type definition. A short example is fine only where the doc already says to include one.
 - Prose is one line per paragraph and one line per list item. Hard wrapping is a nit unless it breaks rendering or generated processing. Code blocks, tables, and diagrams keep their own line breaks.
 - A new or renamed RFC is linked from `doc/rfc/index.md`, and links to the old path are updated.
@@ -44,18 +44,18 @@ A failed check is a fact. Report the target and the first error. Do not turn a s
 
 Read [`lenses.md`](lenses.md). Run a lens only when its files changed:
 
-- **Architecture and boundaries** — `go`, `proto`, `sql`, `build`, or `config` is not `none`.
-- **Correctness and failure modes** — `go`, `tests`, `python`, `shell`, `proto`, `sql`, or `config` is not `none`.
-- **Simplicity and clarity** — `go`, `tests`, `python`, `shell`, `proto`, `sql`, `build`, `config`, or `other` is not `none`.
-- **Tests and hermeticness** — `go`, `tests`, `python`, `shell`, `build`, `config`, `generated`, or `other` is not `none`.
+- **Architecture and boundaries** — `go`, `web`, `proto`, `sql`, `build`, or `config` is not `none`.
+- **Correctness and failure modes** — `go`, `web`, `tests`, `python`, `shell`, `proto`, `sql`, or `config` is not `none`.
+- **Simplicity and clarity** — `go`, `web`, `tests`, `python`, `shell`, `proto`, `sql`, `build`, `config`, or `other` is not `none`.
+- **Tests and hermeticness** — `go`, `web`, `tests`, `python`, `shell`, `build`, `config`, `generated`, or `other` is not `none`.
 - **Operability** — the diff changes logging, metrics, or an error returned to a caller.
 - **Docs and RFCs** — `docs` is not `none`.
 
 Generated files (`protopb/`, `mock/`, `*_mock.go`, `*.pb.go`) are not a lens of their own. Each lens checks whether they were regenerated, and does not review them line by line.
 
 When you can start subagents, start one per applicable lens in parallel. Give each the lens brief, the normalized intent and its source, the `review-scope` output, the diff, and nothing from the conversation that wrote the change. When you cannot, finish one lens and set it aside before reading the next brief.
 
-Pass a lens the smells that match it: `secondary-index` and `extension-factory` to architecture; `narration-comment` to simplicity; `sleep`, `error-string-assert`, `external-test-package`, `repo-root`, and `shell-script` to tests and hermeticness; `formatted-log` to operability. The lens confirms or drops each one.
+Pass a lens the smells that match it: `secondary-index`, `extension-factory`, and `internal-reference` to architecture; `narration-comment` to simplicity; `sleep`, `error-string-assert`, `external-test-package`, `repo-root`, `shell-script`, and `new-workflow` to tests and hermeticness; `formatted-log` to operability. The lens confirms or drops each one.
 
 If the diff is too large to pass, give the reviewer the file list and have it read the files. Anything unread is listed in the report, and the verdict is incomplete.
 
@@ -67,7 +67,8 @@ If the diff is too large to pass, give the reviewer the file list and have it re
 - Severity is based on consequence: **Blocker** means reproducible merge-unsafe behavior such as data loss, incorrect state, outage, security exposure, or incompatible rollout. **Should-fix** means a reachable material defect with a bounded fix appropriate to this change. **Nit** means style, preference, or process consistency without behavioral impact. Confidence is high, medium, or low.
 - A question is a missing fact, not a severity. A material unresolved question makes coverage incomplete.
 - Nits stay out unless the user asked for a wider pass.
-- Sweep `AGENTS.md` for rules no lens covered: layout and import paths, committed proto generation, entity field comments, string enums, int64 milliseconds, Makefile target order, and commit shape when the range has commits (conventional, subject under 70 characters, one line per paragraph, no `Co-Authored-By` / `Co-authored-by`).
+- Sweep `AGENTS.md` for rules no lens covered: layout and import paths, committed proto generation, entity field comments, string enums, int64 milliseconds, Makefile target order, the Design Defaults, and commit shape when the range has commits (conventional, subject under 70 characters, one line per paragraph, no `Co-Authored-By` / `Co-authored-by`, no leftover `# Conflicts:` or rebase-editor lines).
+- The repository is public. An Uber-internal name in the diff, a commit message, or the PR body is a **Should-fix** under Architecture and contracts, whether or not `internal-reference` fired; grep the commit messages yourself, since the script scans only the diff.
 - Commit-shape findings must quote the offending subject or trailer from `git log <base>..HEAD` (or the named commit). Drop any claim that contradicts the message body you just read. A `Co-authored-by` trailer is a **Nit** (process/policy), never Blocker or Should-fix, and belongs under Nits only when the user asked for nits or for a commit-message pass.
 - List files in scope that were not read, checks that were skipped, and lenses that did not finish.
 
 
@@ -17,6 +17,7 @@
     "go",
     "tests",
     "python",
+    "web",
     "proto",
     "sql",
     "build",
@@ -37,6 +38,13 @@
     "go.sum",
 }
 CONFIG_SUFFIXES = (".json", ".toml", ".yaml", ".yml")
+WEB_SUFFIXES = (".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".css")
+WEB_TEST_PATTERN = re.compile(r"\.(test|spec)\.[cm]?[jt]sx?$")
+# Uber-internal names that must not appear in this public repository.
+INTERNAL_REFERENCE_PATTERN = re.compile(
+    r"uberinternal|code\.uber\.internal|\b(go|web|java)-code\b|\buber-code\b",
+    re.IGNORECASE,
+)
 
 
 @dataclass(frozen=True)
@@ -140,14 +148,20 @@ def kind_of(
         return "sql"
     if path.endswith(".proto"):
         return "proto"
-    if path.endswith(("_test.go", "_test.py")) or name.startswith("test_") and path.endswith(".py"):
+    if (
+        path.endswith(("_test.go", "_test.py"))
+        or name.startswith("test_") and path.endswith(".py")
+        or WEB_TEST_PATTERN.search(path)
+    ):
         return "tests"
     if is_generated(path):
         return "generated"
     if path.endswith(".go"):
         return "go"
     if path.endswith(".py"):
         return "python"
+    if path.endswith(WEB_SUFFIXES):
+        return "web"
     if path.endswith((".sh", ".bash", ".zsh")):
         return "shell"
     if path.endswith(".md") or path.startswith("doc/"):
@@ -293,6 +307,8 @@ def analyze_added_line(path: str, number: int, text: str) -> list[tuple[str, str
         results.append(("SMELL", "secondary-index"))
     if is_go and "extension" in PurePosixPath(path).parts and "NewFactory" in text:
         results.append(("SMELL", "extension-factory"))
+    if not generated and INTERNAL_REFERENCE_PATTERN.search(text):
+        results.append(("SMELL", "internal-reference"))
     if is_go and narration_comment(text):
         results.append(("SMELL", "narration-comment"))
     if (
@@ -385,6 +401,19 @@ def mock_source_hints(
     return hints
 
 
+def new_workflow_hints(changes: list[Change]) -> list[tuple[str, str]]:
+    return [
+        (
+            "SMELL",
+            f"{escape_path(change.path)}:1: new-workflow: "
+            "confirm this cannot be a job in .github/workflows/ci.yml",
+        )
+        for change in sorted(changes, key=lambda change: change.path)
+        if change.status in {"A", "?"}
+        and change.path.startswith(".github/workflows/")
+    ]
+
+
 def shell_script_hints(
     repo: Path, changes: list[Change], treeish: str | None = None
 ) -> list[tuple[str, str]]:
@@ -496,6 +525,7 @@ def main() -> None:
     target_tree = commit if mode == "commit" else "HEAD" if mode == "range" else None
     hits.extend(mock_source_hints(repo, changes, target_tree))
     hits.extend(shell_script_hints(repo, changes, target_tree))
+    hits.extend(new_workflow_hints(changes))
     classified = classify_changes(changes, repo, target_tree)
 
     print(f"target: {mode}")