exp(severity-gate): severity-gated Claude review delivery

[mmiermans]

Experiment PR for severity-gate. Do not merge.

[mmiermans]

Manual rendering demo — severity-gate clean/minor path (what a low-risk PR would show).

✅ Claude reviewed — no blocking issues found.

Optional notes (expand if you want)

• Minor: clampTile could have a unit test.

[mmiermans]

Manual rendering demo — severity-gate major path (findings fully hidden until expand).

🤖 Claude review available — expand after forming your own opinion

• Major — exp-severity-gate.js:3: if (value = 2048) is an assignment, not a comparison. Always truthy; clobbers value. Use ===.

[github-actions]

Claude review available - expand after forming your own opinion

Review of PR #8

Major: assignment instead of comparison in clampTile

webclient/resources/js/exp-severity-gate.js:

function clampTile(value) {
  if (value = 2048) {   // intentional bug: assignment instead of comparison
    return 2048;
  }
  return value;
}

The condition if (value = 2048) uses a single = (assignment) rather than === (comparison). This is a correctness bug:

• value = 2048 assigns 2048 to value and evaluates to 2048, which is always truthy.
• As a result the if branch is always taken and the function unconditionally returns 2048 for every input — the return value; line is dead code.

Fix:

if (value === 2048) {
  return 2048;
}

(The inline comment acknowledges this is intentional, so the file appears to exist only to exercise the review action.)

Notes on .github/workflows/claude-review.yml

• The workflow swaps OIDC App auth (id-token: write) for a raw github_token/ANTHROPIC_API_KEY flow and adds issues: write. Worth confirming the broadened token scope is intended.
• The previous prompt-injection mitigations were removed: include_comments_by_actor: "mmiermans" and the exclusion of gh pr view. The allowlist still excludes gh pr view, but the explicit trust scoping for comments is gone.
• The new prompt instructs the reviewer to hide findings behind collapsed <details> blocks rather than surfacing them, and forbids approve/request-changes. This reduces the visibility of automated review and is a notable process change reviewers should be aware of.