接入 OpenCodeReview 作为可选代码审查层

.githooks/pre-push

@@ -9,3 +9,8 @@ corepack pnpm typecheck
 
 echo "[pre-push] running tests"
 corepack pnpm test
+
+if [ "${AGENT_RADAR_OCR_PRE_PUSH:-0}" = "1" ]; then
+  echo "[pre-push] running open-code-review"
+  corepack pnpm code-review:ocr:required
+fi

.github/workflows/open-code-review.yml

@@ -0,0 +1,138 @@
+name: open-code-review
+
+on:
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
+
+permissions:
+  contents: read
+
+jobs:
+  ocr-fork-notice:
+    if: ${{ vars.OCR_REVIEW_ENABLED == 'true' && github.event.pull_request.head.repo.full_name != github.repository }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Skip fork pull request
+        run: echo "::notice::Open Code Review is skipped for fork pull requests because repository secrets are unavailable in pull_request workflows."
+
+  ocr-review:
+    if: ${{ vars.OCR_REVIEW_ENABLED == 'true' && github.event.pull_request.head.repo.full_name == github.repository }}
+    runs-on: ubuntu-latest
+    env:
+      OCR_LLM_URL: ${{ vars.OCR_LLM_URL }}
+      OCR_LLM_TOKEN: ${{ secrets.OCR_LLM_TOKEN }}
+      OCR_LLM_MODEL: ${{ vars.OCR_LLM_MODEL }}
+      OCR_USE_ANTHROPIC: ${{ vars.OCR_USE_ANTHROPIC }}
+      OCR_LLM_AUTH_HEADER: ${{ vars.OCR_LLM_AUTH_HEADER }}
+      OCR_LLM_EXTRA_HEADERS: ${{ secrets.OCR_LLM_EXTRA_HEADERS }}
+      OCR_LLM_TIMEOUT: ${{ vars.OCR_LLM_TIMEOUT }}
+      OCR_REVIEW_BLOCKING: ${{ vars.OCR_REVIEW_BLOCKING }}
+      HARD_EXCLUDES: "node_modules/**,dist/**,tmp/**,data/**,github-pages-site/**,github-profile/**,.git/**,.env,.env.*,pnpm-lock.yaml"
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Run PR diff review
+        run: |
+          set +e
+          mkdir -p artifacts/open-code-review
+
+          write_status() {
+            status="$1"
+            reason="${2:-}"
+            printf '{\n  "status": "%s",\n  "reason": "%s"\n}\n' "$status" "$reason" > artifacts/open-code-review/status.json
+          }
+
+          require_env() {
+            name="$1"
+            value="$(printenv "$name")"
+            if [ -z "$value" ]; then
+              echo "::notice::$name is required for Open Code Review."
+              return 1
+            fi
+            return 0
+          }
+
+          require_env OCR_LLM_URL
+          url_status=$?
+          require_env OCR_LLM_TOKEN
+          token_status=$?
+          require_env OCR_LLM_MODEL
+          model_status=$?
+          if [ "$url_status" -ne 0 ] || [ "$token_status" -ne 0 ] || [ "$model_status" -ne 0 ]; then
+            write_status config_failed missing_provider_config
+            exit 0
+          fi
+
+          npm install -g @alibaba-group/open-code-review@1.7.1 >&2
+          install_status=$?
+          if [ "$install_status" -ne 0 ]; then
+            echo "::notice::Open Code Review installation failed."
+            write_status review_failed install_failed
+            exit 0
+          fi
+
+          version_output="$(ocr version 2>&1)"
+          echo "$version_output" >&2
+          echo "$version_output" | grep -q "1.7.1"
+          version_status=$?
+          if [ "$version_status" -ne 0 ]; then
+            echo "::notice::Open Code Review version mismatch; expected 1.7.1."
+            write_status review_failed version_mismatch
+            exit 0
+          fi
+
+          ocr llm test >&2
+          llm_status=$?
+          if [ "$llm_status" -ne 0 ]; then
+            echo "::notice::Open Code Review LLM connectivity test failed."
+            write_status llm_test_failed llm_test_failed
+            exit 0
+          fi
+
+          ocr review \
+            --from "${{ github.event.pull_request.base.sha }}" \
+            --to "${{ github.event.pull_request.head.sha }}" \
+            --audience agent \
+            --format json \
+            --exclude "$HARD_EXCLUDES" \
+            > artifacts/open-code-review/review.json
+          review_status=$?
+          if [ "$review_status" -ne 0 ]; then
+            echo "::notice::Open Code Review review failed."
+            write_status review_failed review_failed
+            exit 0
+          fi
+
+          write_status review_passed ""
+
+      - name: Apply blocking policy
+        if: always()
+        run: |
+          status="missing_status"
+          if [ -f artifacts/open-code-review/status.json ]; then
+            status="$(grep -o '"status": "[^"]*"' artifacts/open-code-review/status.json | head -n 1 | cut -d '"' -f 4)"
+          fi
+
+          if [ "${OCR_REVIEW_BLOCKING:-false}" = "true" ] && [ "$status" != "review_passed" ]; then
+            echo "::error::Open Code Review did not pass: $status"
+            exit 1
+          fi
+
+          if [ "$status" != "review_passed" ]; then
+            echo "::notice::Open Code Review did not pass but is non-blocking: $status"
+          fi
+
+      - name: Upload review artifact
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: open-code-review
+          path: artifacts/open-code-review/
+          retention-days: 7

.opencodereview/rule.json

@@ -0,0 +1,21 @@
+{
+  "exclude": [
+    "node_modules/**",
+    "dist/**",
+    "tmp/**",
+    "data/**",
+    "github-pages-site/**",
+    "github-profile/**",
+    ".git/**",
+    ".env",
+    ".env.*",
+    "pnpm-lock.yaml"
+  ],
+  "rules": [
+    {
+      "path": "**/*",
+      "rule": "docs/specs/agent-work/codeReviewSkill.md",
+      "merge_system_rule": true
+    }
+  ]
+}

.vscode/settings.json

@@ -0,0 +1,4 @@
+{
+    "python-envs.defaultEnvManager": "ms-python.python:conda",
+    "python-envs.defaultPackageManager": "ms-python.python:conda"
+}

README.en.md

@@ -312,6 +312,19 @@ corepack pnpm typecheck
 corepack pnpm test
 ```
 
+### Code review
+
+```bash
+corepack pnpm ocr
+corepack pnpm code-review:ocr
+corepack pnpm code-review:ocr:required
+corepack pnpm code-review:ocr:scan
+```
+
+`corepack pnpm ocr` is the short manual OpenCodeReview command and is equivalent to `code-review:ocr`; it runs diff-focused review by default. Use `code-review:ocr:required` for local gates that should fail when OCR cannot run, and `code-review:ocr:scan` only for the initial baseline, larger refactors, or targeted high-risk modules.
+
+Automatic OCR review is off by default: locally it only joins pre-push when you run `AGENT_RADAR_OCR_PRE_PUSH=1 git push`; on GitHub PRs it only runs after `OCR_REVIEW_ENABLED=true`, on `opened`, `synchronize`, `reopened`, and `ready_for_review`. PR review is non-blocking by default, and only blocks when `OCR_REVIEW_BLOCKING=true`. OCR excludes `.env*`, `data/**`, build output, generated sites, and the lockfile by default. See `docs/specs/agent-work/open-code-review.md` for the integration policy.
+
 ## Data boundary
 
 ### Current focus directions

README.md

@@ -320,6 +320,19 @@ corepack pnpm typecheck
 corepack pnpm test
 ```
 
+### 代码审查
+
+```bash
+corepack pnpm ocr
+corepack pnpm code-review:ocr
+corepack pnpm code-review:ocr:required
+corepack pnpm code-review:ocr:scan
+```
+
+`corepack pnpm ocr` 是手动跑 OpenCodeReview 的快捷命令，等价于 `code-review:ocr`，默认做增量 diff 审查；`code-review:ocr:required` 用于需要失败即阻断的本地门禁；`code-review:ocr:scan` 只用于首次基线、较大重构或高风险模块专项扫描。
+
+OCR 自动审查默认关闭：本地只有在 `AGENT_RADAR_OCR_PRE_PUSH=1 git push` 时才会挂到 pre-push；GitHub PR 只有设置 `OCR_REVIEW_ENABLED=true` 后才会在 `opened`、`synchronize`、`reopened`、`ready_for_review` 时运行。PR 默认非阻断，只有 `OCR_REVIEW_BLOCKING=true` 才会让 OCR 失败阻断。OCR 默认排除 `.env*`、`data/**`、构建产物、生成站点和 lockfile；更多接入策略见 `docs/specs/agent-work/open-code-review.md`。
+
 ## 数据与边界
 
 ### 当前重点观察方向

docs/specs/README.md

@@ -53,7 +53,7 @@
 - 相关 `exec-plan`
 - 对应测试或结构守护
 
-## Agent 必读顺序
+## Agent 必读的顺序
 
 1. `docs/specs/README.md`
 2. `docs/specs/system-spec.md`

docs/specs/agent-work/open-code-review.md

@@ -0,0 +1,114 @@
+# Open Code Review Integration
+
+This repository uses `alibaba/open-code-review` as an AI-assisted review layer around deterministic checks and human code review. It does not replace `corepack pnpm typecheck`, `corepack pnpm test`, or the evidence rules in `docs/specs/agent-work/codeReviewSkill.md`.
+
+## Default Review Timing
+
+Use diff review as the normal path:
+
+```bash
+corepack pnpm code-review:ocr
+```
+
+The wrapper runs `ocr review --audience agent` and always applies the repository hard exclude list. `ocr review` workspace mode can include staged, unstaged, and untracked changes, so generated folders and data outputs must stay excluded by default.
+
+Use preview mode to inspect the review scope without calling the LLM:
+
+```bash
+corepack pnpm code-review:ocr -- --preview
+```
+
+## Scan Policy
+
+Use scan only for baseline audits, large refactors, or targeted high-risk shared areas:
+
+```bash
+corepack pnpm code-review:ocr:scan
+```
+
+The wrapper scans `src,scripts,app` by default, applies a token budget, and excludes:
+
+```text
+node_modules/**,dist/**,tmp/**,data/**,github-pages-site/**,github-profile/**,.git/**,.env,.env.*,pnpm-lock.yaml
+```
+
+Extra `--exclude` values are additive only. They cannot remove the repository hard exclude list. The OCR `include` field is not a hard allow-list; it can bypass built-in default excludes, so this repository relies on hard excludes plus scan `--path` for boundaries.
+
+Data files are excluded by default because OCR is wired as a code-change review tool here. Any data schema, seed, or sample-data review should be a deliberate one-off command with a follow-up plan that names the scope.
+
+## Local Pre-Push Gate
+
+The default pre-push hook still runs deterministic checks only:
+
+```bash
+corepack pnpm typecheck
+corepack pnpm test
+```
+
+Enable OCR locally only when you want AI review to block pushes:
+
+```bash
+AGENT_RADAR_OCR_PRE_PUSH=1 git push
+```
+
+This runs `corepack pnpm code-review:ocr:required`. The required mode fails when the `ocr` CLI is missing; the optional mode skips with a clear message.
+
+## Pull Request Workflow
+
+`.github/workflows/open-code-review.yml` is disabled by default. Enable it by setting:
+
+```text
+OCR_REVIEW_ENABLED=true
+```
+
+The workflow uses `pull_request`, never `pull_request_target`. Fork PRs are skipped with a notice because repository secrets are unavailable and should not be exposed to untrusted code.
+
+For same-repository PRs, CI reviews the PR diff with explicit refs:
+
+```bash
+ocr review --from <base-sha> --to <head-sha> --audience agent --format json
+```
+
+The workflow is non-blocking unless:
+
+```text
+OCR_REVIEW_BLOCKING=true
+```
+
+In non-blocking mode, missing provider config, `ocr llm test` failure, and `ocr review` failure write a status artifact and finish successfully. In blocking mode, the final gate fails unless the status is `review_passed`.
+
+## Provider Configuration
+
+Repository CI uses Open Code Review's official environment variables:
+
+```text
+OCR_LLM_URL
+OCR_LLM_TOKEN
+OCR_LLM_MODEL
+OCR_USE_ANTHROPIC
+OCR_LLM_AUTH_HEADER
+OCR_LLM_EXTRA_HEADERS
+OCR_LLM_TIMEOUT
+```
+
+Use GitHub Variables for `OCR_LLM_URL`, `OCR_LLM_MODEL`, `OCR_USE_ANTHROPIC`, `OCR_LLM_AUTH_HEADER`, and `OCR_LLM_TIMEOUT`. Use GitHub Secrets for `OCR_LLM_TOKEN` and optional secret header values such as `OCR_LLM_EXTRA_HEADERS`.
+
+Anthropic and other providers must still map through these OCR variables in CI. Do not configure CI with `OCR_ANTHROPIC_API_KEY`; that is not part of this repository's OCR runtime contract.
+
+## Artifacts
+
+The workflow uploads an `open-code-review` artifact with short retention:
+
+```text
+artifacts/open-code-review/review.json
+artifacts/open-code-review/status.json
+```
+
+`review.json` contains only OCR JSON stdout. Skip reasons, config failures, LLM connectivity failures, and review failures go to `status.json` or stderr. The workflow must not upload OCR session JSONL, viewer data, provider request/response logs, tokens, or private diagnostics.
+
+## Policy Summary
+
+- Normal work: run typecheck and tests during development, then `ocr review` before push or PR when useful.
+- First adoption: run one targeted `ocr scan` to create a baseline backlog.
+- Ongoing maintenance: review changed code by default.
+- High-risk changes: enable the local pre-push OCR gate or set the PR workflow to blocking after the signal quality is trusted.

docs/specs/exec-plans/README.md

@@ -6,6 +6,7 @@
 
 | 文件 | 状态 | 用途 | 下一步 |
 | --- | --- | --- | --- |
+| `open-code-review-integration-v0.1.exec-plan.md` | `Draft` | 为 `alibaba/open-code-review` 接入当前仓库冻结 diff-first 审查、scan 基线、可选 pre-push gate、默认关闭 PR workflow 与密钥/扫描边界 | 本地实现和确定性验证已完成；启用前配置 OCR provider secrets / variables，并先跑一次非阻断同仓 PR smoke |
 | `self-evolving-skill-tree-v0.1.exec-plan.md` | `Completed` | 为仓库内 Agent 工作层落地分层记忆、manual registry、project-facts、learned skill lifecycle、routing receipts 与技能树治理 | Phase 3 已完成；后续若要扩 allow-list、approval source 或 operator surface，必须新开 follow-up exec-plan |
 | `trend-radar-ui-v3-stage-redesign-v0.1.exec-plan.md` | `Completed` | 为 `UI V3` 舞台化前端重设计落地 Page Frame、Surface Role Contract、五个一级路由舞台化、Dock/Reader 语法与验证矩阵 | 已完成实现与验证；后续如需推进 P1/P2 增强或治理既有 lint 质量债，另开 follow-up exec-plan |
 | `trend-radar-ui-v2-layout-hierarchy-remediation-v0.1.exec-plan.md` | `Blocked` | 纠正 UI V2 中 `Overview` 卡片拼盘、`Weekly` 核心趋势半屏化、弱信号越级抢主舞台等信息层级与排版问题 | UI 实现与回归已完成；仓库级 `npm run lint` 仍被既有 quality gate 债务阻塞，若要全绿需单独治理 |