ci: configure AI pull request reviews

.coderabbit.yaml

@@ -0,0 +1,40 @@
+# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
+
+language: "en-US"
+tone_instructions: "Be concise. Focus on correctness, security, regressions, and missing tests. Avoid style-only comments."
+
+reviews:
+  profile: "chill"
+  request_changes_workflow: false
+  high_level_summary: true
+  review_status: true
+  review_details: false
+  sequence_diagrams: false
+  estimate_code_review_effort: false
+  poem: false
+
+  path_filters:
+    - "!bun.lock"
+    - "!**/dist/**"
+
+  auto_review:
+    enabled: true
+    drafts: false
+    auto_incremental_review: true
+    labels:
+      - "!skip-ai-review"
+
+  finishing_touches:
+    docstrings:
+      enabled: false
+    unit_tests:
+      enabled: false
+    autofix:
+      enabled: false
+    fix_ci:
+      enabled: false
+    resolve_merge_conflict:
+      enabled: false
+
+chat:
+  auto_reply: true

cubic.yaml

@@ -0,0 +1,68 @@
+# yaml-language-server: $schema=https://cubic.dev/schema/cubic-repository-config.schema.json
+
+version: 1
+
+reviews:
+  enabled: true
+  sensitivity: medium
+  incremental_commits: true
+  check_drafts: false
+  architecture_diagrams: false
+  external_contributors_require_manual_review: false
+  resolve_threads_when_addressed: true
+
+  auto_approve_behavior: disabled
+  auto_approve: disabled
+  ultrareview: manual
+
+  custom_instructions: |
+    Act as the architecture-focused reviewer for ArchCode.
+    Focus on cross-file regressions, ownership violations, concurrency,
+    lifecycle correctness, security boundaries, and missing tests.
+    Avoid repeating style-only feedback likely covered by other reviewers.
+
+  ignore:
+    files:
+      - bun.lock
+      - dist/**
+      - apps/web/dist/**
+    pr_labels:
+      - skip-ai-review
+    max_changed_lines: 10000
+
+  custom_rules:
+    - name: ArchCode architecture contract
+      description: >
+        Enforce the repository architecture, dependency boundaries,
+        runtime ownership rules, and validation requirements documented
+        in AGENTS.md.
+      file_paths:
+        - AGENTS.md
+
+    - name: Workspace dependency boundaries
+      description: >
+        Verify that apps/web does not depend on agent-core or server,
+        protocol and utils remain runtime-light, and new dependencies
+        follow the documented monorepo dependency graph.
+
+    - name: Session lifecycle ownership
+      description: >
+        Flag code that bypasses SessionExecutionManager as the sole owner
+        of execution lifecycle, admission, recovery, abort, and terminal state.
+      include:
+        - packages/agent-core/src/**
+
+    - name: Tool output security
+      description: >
+        Ensure raw tool outputs cannot bypass Registry finalization,
+        redaction, bounded artifact storage, or workspace security guards.
+      include:
+        - packages/agent-core/src/**
+
+pr_descriptions:
+  generate: false
+
+issues:
+  fix_with_cubic_buttons: false
+  pr_comment_fixes: false
+  fix_commits_to_pr: false