feat(#1654): scope review to own commits on stacked/cherry-picked PRs

.skillsaw-baseline.json

@@ -80,9 +80,9 @@
       "fingerprint": "0285e1a7243ebead",
       "rule_id": "context-budget",
       "file_path": "skills/pr-review/SKILL.md",
-      "message": "Estimated 17,060 tokens exceeds skill error limit of 6,000",
+      "message": "Estimated 17,111 tokens exceeds skill error limit of 6,000",
       "severity": "error",
-      "value": 17060,
+      "value": 17111,
       "baseline_mode": "ceiling"
     },
     {

Makefile

@@ -84,6 +84,7 @@ script-test:
 	$(call run-timed,bash scripts/pre-review-test.sh)
 	$(call run-timed,bash scripts/pr-review-challenger-contract-test.sh)
 	$(call run-timed,bash scripts/pr-review-remediation-test.sh)
+	$(call run-timed,bash scripts/pr-review-dependency-scope-test.sh)
 	$(call run-timed,bash scripts/post-review-test.sh)
 	$(call run-timed,bash scripts/risk-tier1-test.sh)
 	$(call run-timed,bash scripts/post-fix-test.sh)

agents/review.md

@@ -258,7 +258,8 @@ mutations on the runner.
   `REVIEW_RISK_VERDICT_THRESHOLD` is not `6`,
   `risk_assessment.score` is below `REVIEW_RISK_VERDICT_THRESHOLD` and
   the assessment is not degraded (when threshold is `6`, the risk
-  verdict gate is disabled and does not block approval)
+  verdict gate is disabled and does not block approval). Dependency
+  scoping does not impose merge ordering or alter these approval criteria.
 - `request-changes` — findings *requiring* resolution: one or more critical or
   high findings; one or more medium-severity findings identifying a
   functional bug (incorrect behavior, permission error, schema violation,

docs/review.md

@@ -166,6 +166,15 @@ The review agent follows the same pre-script / sandbox / post-script pipeline as
 
 On re-review, the sandbox receives a validated `fullsend:review-findings-v2` projection containing `action`, severity, category, file, optional line, id, optional `actionable`, and an `{id, status}` disposition per prior id—not prior descriptions, remediation text, rationales, evidence, or review-thread bodies. Immediately before sandbox creation, the host fetches current thread state and marks eligible findings dismissed only when a verified write-or-higher human other than the PR author resolved a thread containing a trusted review-bot comment with the exact finding-id stamp. Unstamped thread comments stay open; path and line are not used as a fallback. A legacy marker without ids is assigned one before sandbox ingress. Resolved and human-dismissed findings stay in the projection with their anchor so they are recognised and not raised again. A null file retains PR-level category context without serving as a path or severity anchor. The pre-script continues to accept v1 markers for existing comments. Only GitHub `app-verified` re-reviews use file-backed records for remediation-candidate matching.
 
+### Stacked and cherry-picked PRs
+
+On GitHub, when the PR author declares another open PR in the same repository
+as a dependency ("depends on #N", "stacked on #N") and the PR's leading
+commits are that PR's commits (same SHAs, or cherry-picks with identical
+patches), non-security review dimensions cover only the PR's own commits.
+Security inspection, protected-path checks, and PR-body defenses cover the
+whole PR. Scoping changes review evidence only. It does not impose merge ordering or prevent an approval under the normal review criteria. The review body identifies the excluded matching commits and their dependency PR. If the commits cannot be matched, or on GitLab, the full diff is reviewed.
+
 ## Time budget
 
 The runner gives the sandbox `timeout_minutes` (45 in