fix: only run .deepreview rules against git-changed output files

The quality gate was treating all file_path outputs as "changed files"
for .deepreview matching. This caused reviews to run on unchanged
reference files (e.g. key_reference_files in exploration steps).

Now intersects output file paths with actual git-changed files before
matching .deepreview rules. Step-specific (dynamic) reviews still run
against all declared outputs since those are explicitly defined.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: nhorton

src/deepwork/jobs/mcp/quality_gate.py

@@ -26,7 +26,7 @@
 from deepwork.review.instructions import (
     write_instruction_files,
 )
-from deepwork.review.matcher import match_files_to_rules
+from deepwork.review.matcher import get_changed_files, match_files_to_rules
 from deepwork.utils.validation import ValidationError, validate_against_schema
 
 logger = logging.getLogger("deepwork.jobs.mcp.quality_gate")
@@ -328,17 +328,27 @@ def run_quality_gate(
     schema_rules, _schema_errors = gen_schema_rules(project_root)
     deepreview_rules.extend(schema_rules)
 
-    # 4. Get the "changed files" list = output file paths
+    # 4. Collect output file paths
     output_files = _collect_output_file_paths(outputs, job)
 
-    # 5. Match .deepreview rules against output files
+    # 5. Match .deepreview rules against output files that are actually changed.
+    # Output files may include unchanged reference files — .deepreview rules
+    # should only fire on files that were actually modified (git diff).
     deepreview_tasks: list[ReviewTask] = []
     if deepreview_rules and output_files:
-        deepreview_tasks = match_files_to_rules(
-            output_files, deepreview_rules, project_root, platform
-        )
+        try:
+            git_changed = get_changed_files(project_root)
+        except Exception:
+            git_changed = []
+        output_set = set(output_files)
+        changed_output_files = [f for f in git_changed if f in output_set]
+        if changed_output_files:
+            deepreview_tasks = match_files_to_rules(
+                changed_output_files, deepreview_rules, project_root, platform
+            )
 
-    # 6. Match dynamic rules against output files
+    # 6. Match dynamic rules (step-specific reviews) against all output files.
+    # These are explicitly defined for specific outputs and should always run.
     dynamic_tasks: list[ReviewTask] = []
     if dynamic_rules and output_files:
         dynamic_tasks = match_files_to_rules(output_files, dynamic_rules, project_root, platform)

tests/unit/jobs/mcp/test_quality_gate.py

@@ -664,6 +664,10 @@ def test_merges_deepreview_and_dynamic_tasks(self, tmp_path: Path) -> None:
                 "deepwork.jobs.mcp.quality_gate.load_all_rules",
                 return_value=([deepreview_rule], []),
             ),
+            patch(
+                "deepwork.jobs.mcp.quality_gate.get_changed_files",
+                return_value=["report.md"],
+            ),
             patch(
                 "deepwork.jobs.mcp.quality_gate.match_files_to_rules",
                 side_effect=[[deepreview_task], [dynamic_task]],
@@ -697,6 +701,58 @@ def test_merges_deepreview_and_dynamic_tasks(self, tmp_path: Path) -> None:
         assert all_tasks[1].rule_name == "external_rule"
         assert result is not None
 
+    def test_deepreview_rules_skip_unchanged_output_files(self, tmp_path: Path) -> None:
+        """Deepreview rules should only match output files that are actually changed in git."""
+        arg = StepArgument(name="refs", description="Reference files", type="file_path")
+        output_ref = StepOutputRef(argument_name="refs", required=False)
+        step = WorkflowStep(name="explore", outputs={"refs": output_ref})
+        job, workflow = _make_job(tmp_path, [arg], step)
+
+        deepreview_rule = ReviewRule(
+            name="python_lint",
+            description="Lint Python files",
+            include_patterns=["**/*.py"],
+            exclude_patterns=[],
+            strategy="matches_together",
+            instructions="Run linting",
+            agent=None,
+            all_changed_filenames=False,
+            unchanged_matching_files=False,
+            precomputed_info_bash_command=None,
+            source_dir=tmp_path,
+            source_file=tmp_path / ".deepreview",
+            source_line=1,
+        )
+
+        with (
+            patch(
+                "deepwork.jobs.mcp.quality_gate.load_all_rules",
+                return_value=([deepreview_rule], []),
+            ),
+            # git says no files changed — output files are just references
+            patch(
+                "deepwork.jobs.mcp.quality_gate.get_changed_files",
+                return_value=[],
+            ),
+            patch(
+                "deepwork.jobs.mcp.quality_gate.match_files_to_rules",
+            ) as mock_match,
+        ):
+            result = run_quality_gate(
+                step=step,
+                job=job,
+                workflow=workflow,
+                outputs={"refs": ["src/foo.py", "src/bar.py"]},
+                input_values={},
+                work_summary=None,
+                project_root=tmp_path,
+            )
+
+        # match_files_to_rules should not be called for deepreview since
+        # no output files are in the git changed set
+        assert mock_match.call_count == 0
+        assert result is None
+
 
 # ---------------------------------------------------------------------------
 # TestValidateJsonSchemas — additional coverage