[tommasobolis]

Closes #1067

Summary

• New ai-review job in framework-release-watch.yml: one leg per release, in parallel with evaluate, fail-fast: false, 15 min. anthropics/claude-code-action pinned by SHA (v1.0.248), model claude-sonnet-5-5. alert embeds the result in the issue under "Impact review (AI, advisory)": Risk (none/low/high), affected symbols with upstream citations, recommended action (bump / adapt adapter / record §8.1 / watch) and confidence.
• scripts/review_framework_release.py builds the prompt (package, versions, release notes, GitHub compare link, adapter module, FRAMEWORKS rows, §8 row plus all of §8.1/§8.2) and validates the structured output (--json-schema). The answer is untrusted: only the schema's fields are kept, Markdown is escaped, HTML and comment markers are stripped, mentions and # refs are neutralised, only http(s) citations are kept, and an answer with credential-shaped text is dropped.
• Hardening: contents: read, no write token; Read/Grep/Glob plus WebFetch limited to github.com, raw.githubusercontent.com and pypi.org; Bash/edit/subagent tools disallowed, reads under /proc denied, --setting-sources user. Only alert writes.
• The key is an ai-review environment secret (develop only, no repo-level secret). The job is skipped on pull_request and on non-develop refs. No key, a failed action or an invalid answer gives a notice plus "Impact review unavailable", and the watch stays green.
• Cost bound: one review per (extra, package, version) via actions/cache (artifacts don't persist across runs).
• New replay dispatch input (LOCKED..LATEST with package) re-runs one past release as a dry run, so the review can be checked against a known break.
• Advisory only: never verification (§0.3), never flips a §8 row.

Test plan

• nox -s typecheck-and-lint test-3.11 new-dependencies commit-identities workflow-lint green; actionlint and zizmor clean
• New tests/unit/test_review_framework_release.py: prompt contents, schema, GitHub-output delimiter, validation, rendering (block markers, HTML, mentions, Markdown, table-cell breakout, credential-shaped text), record and load
• test_check_framework_releases.py: compare_url, replay, impact precedence (this run → earlier review → unavailable), --impacts
• test_ci_workflows.py: ai-review is the only job on environment: ai-review in any workflow, never runs on pull_request, contents: read, read/fetch-only tools, key named only in that job; replay is a dry run
• Local claude -p with the job's exact flags: anthropic 0.116.0..1.0.0 gave Risk: high (record §8.1); crewai 1.15.23..1.15.27 gave Risk: low (bump)

Post-deploy steps

After merge, on develop:

1. gh workflow run framework-release-watch.yml --ref develop -f package=anthropic -f replay=0.116.0..1.0.0 → summary shows Risk: high.
2. gh workflow run framework-release-watch.yml --ref develop -f package=crewai → none/low.
3. Temporarily remove ANTHROPIC_API_KEY from the ai-review environment and dispatch once → run green, issue says "Impact review unavailable"; then restore the key.

🤖 Generated with Claude Code