chore(review): adopt ponytail policy and enable automatic review (#2521)

* chore(review): retire the curator repository review skill

Signed-off-by: oliver könig <okoenig@nvidia.com>

* chore(review): enable automatic review on ready status changes

Signed-off-by: oliver könig <okoenig@nvidia.com>

---------

Signed-off-by: oliver könig <okoenig@nvidia.com>

Author: ko3n1g

.github/autobot/review-config.yml

@@ -0,0 +1,5 @@
+auto-review:
+  enabled: true
+  mode: comment
+  on: status_change
+  when: ready_for_review

CONTRIBUTING.md

@@ -222,9 +222,9 @@ all options. The retired `/claude review` and `/claude strict-review` commands
 only reply with migration instructions; they do not run or automatically
 request a review.
 
-The repository policy lives in `skills/pr-review/SKILL.md`. The review service
-must load this rubric from protected `main`, not the pull-request branch.
-Before deploying this migration, publish the rubric, register its repository
-profile, and verify a Ready plugin snapshot containing it. Until those
-prerequisites are verified, do not rely on the redirect as evidence that the
-repository-specific review policy is active.
+Curator's review profile in CI-Events selects its local copy of the
+[Ponytail review skill](https://github.com/NVIDIA-NeMo/CI-Events-Workflows/blob/main/skills/ponytail-review/SKILL.md).
+The review service loads an immutable plugin snapshot published from CI-Events'
+protected `main` branch. CI-Events owns profile registration and publication;
+the formal review service owns review output and submission. Before activating
+the profile, verify a Ready `ponytail-skills` snapshot containing `ponytail-review`.

skills/pr-review/SKILL.md

@@ -51,18 +51,6 @@ def test_review_redirect_is_least_privilege_and_does_not_execute_review() -> Non
     )
 
 
-def test_formal_review_rubric_is_inert_and_uses_formal_submission() -> None:
-    rubric = (ROOT / "skills/pr-review/SKILL.md").read_text()
-    metadata = yaml.safe_load(rubric.split("---", 2)[1])
-    assert metadata["name"] == "pr-review"
-    assert metadata["disable-model-invocation"] is True
-    assert metadata["user_invocable"] is False
-    assert "mode=light" in rubric
-    assert "mode=strict" in rubric
-    assert "Do not run GitHub commands or" in rubric
-    assert "Never approve an incomplete" in rubric
-
-
 def test_review_redirect_workflow_has_no_other_execution_or_permissions() -> None:
     workflow = yaml.safe_load((ROOT / ".github/workflows/claude-review.yml").read_text())
     assert workflow["permissions"] == {}
@@ -71,23 +59,6 @@ def test_review_redirect_workflow_has_no_other_execution_or_permissions() -> Non
     assert events == {"issue_comment": {"types": ["created"]}}
 
 
-def test_review_policy_preserves_the_retired_light_review_rules() -> None:
-    rubric = (ROOT / "skills/pr-review/SKILL.md").read_text()
-    for rule in (
-        "Critical bugs or logic errors",
-        "Typos in code, comments, or strings",
-        "Missing or insufficient test coverage for changed code",
-        "Outdated or inaccurate documentation affected by the changes",
-        "Style preferences or formatting",
-        "Minor naming suggestions",
-        "Architectural opinions or refactoring ideas",
-        "Performance unless there is a clear, measurable issue",
-    ):
-        assert rule in rubric
-    assert "post comments directly" in rubric
-    assert 'post "LGTM"' not in rubric
-
-
 @pytest.mark.parametrize(
     "notice", ["Use /review", "Use /review mode=strict", "$(touch injected) `touch injected` ' \" ;\n/review"]
 )