Fix: reusable-review.yml missing REVIEW_FINDING_SEVERITY_THRESHOLD env var

[fullsend-ai-retro]

What happened

PR #2758 migrated the review agent harness from host_files with expand: true (which silently substitutes empty string for unset vars via os.Expand) to env.sandbox (which errors on unset vars via os.LookupEnv). The variable REVIEW_FINDING_SEVERITY_THRESHOLD was moved into env.sandbox at internal/scaffold/fullsend-repo/harness/review.yaml:43, but the reusable workflow .github/workflows/reusable-review.yml does not define it in the agent step's env: block (lines 169–176). Qodo's code review bot flagged this on Jun 29, but the review agent's final run said 'Looks good to me' and the PR was merged on Jul 2 without addressing it. Any repo using the default scaffold workflow without externally defining REVIEW_FINDING_SEVERITY_THRESHOLD (e.g., via vars.REVIEW_FINDING_SEVERITY_THRESHOLD) will hit a harness validation error before the review agent starts.

What could go better

This is a concrete bug with high confidence — the validation logic in internal/harness/harness.go:542-583 will reject any ${VAR} reference in env.sandbox where the host variable is unset. The reusable workflow is the canonical caller and does not set this variable. Repos that define it via GitHub Actions variables would be unaffected, which may explain why it hasn't caused widespread failures yet. But any new repo using the default scaffold without custom variable configuration would break on the first review dispatch.

Proposed change

Add REVIEW_FINDING_SEVERITY_THRESHOLD to the env: block of the 'Run review agent' step in .github/workflows/reusable-review.yml, defaulting to the GitHub Actions variable:

env:
  REVIEW_FINDING_SEVERITY_THRESHOLD: ${{ vars.REVIEW_FINDING_SEVERITY_THRESHOLD }}

This ensures the variable is always present (possibly empty), satisfying os.LookupEnv validation while preserving the optional behavior where empty/unset means 'low'. As ADR 0055 migration continues for other agents (triage, code, fix, retro, prioritize), audit each migration for similar unset-variable gaps.

Validation criteria

After the fix: (1) fullsend run with the review harness succeeds on a clean environment where REVIEW_FINDING_SEVERITY_THRESHOLD is not set externally. (2) The scaffold integration tests pass. (3) A new repo using the default scaffold can dispatch the review agent without env validation errors.

---

Generated by retro agent from #2758

[fullsend-ai-triage]

🤖 Finished Triage · ✅ Success · Started 3:15 PM UTC · Completed 3:18 PM UTC
Commit: 9f4f2b6 · View workflow run →

[fullsend-ai-triage]

Triage Summary

This is a confirmed bug introduced by the ADR 0055 migration in PR #2758. The review harness (review.yaml:43) references ${REVIEW_FINDING_SEVERITY_THRESHOLD} in env.sandbox, but the canonical caller (.github/workflows/reusable-review.yml) does not pass this variable in the agent step's env: block. Since env.sandbox uses os.LookupEnv (which errors on unset vars, unlike the previous os.Expand behavior), any repo without this variable externally defined will hit a validation error.

Fix: Add the variable to the env: block of the "Run review agent" step in reusable-review.yml:

env:
  REVIEW_FINDING_SEVERITY_THRESHOLD: ${{ vars.REVIEW_FINDING_SEVERITY_THRESHOLD }}

This satisfies os.LookupEnv while preserving the optional behavior — post-review.sh already defaults to low when the value is empty.

Related issues: #2936 tracks improving the review agent to detect such cross-file gaps in future migrations. #2333 (the original feature request for the threshold) is unrelated to this bug.

Proposed test case:

1. Run harness validation with REVIEW_FINDING_SEVERITY_THRESHOLD unset
   → Expected: validation passes (no error)
2. Run harness validation with REVIEW_FINDING_SEVERITY_THRESHOLD="medium"
   → Expected: value passes through to sandbox correctly
3. Run post-review.sh with empty REVIEW_FINDING_SEVERITY_THRESHOLD
   → Expected: defaults to "low" (existing behavior preserved)

This is a good-first-issue candidate — the fix is a one-line addition with clear validation criteria.

---

Labels: Confirmed harness/dispatch bug affecting the review agent with high priority since it breaks default scaffold repos.

[fullsend-ai-coder]

🤖 Finished Code · ❌ Failure · Started 3:19 PM UTC · Completed 3:24 PM UTC
Commit: 9f4f2b6 · View workflow run →