[FEATURE] Harness-enforced adversarial review gate on every commit (unbypassable PreCommit)

Preflight Checklist

• [x] I have searched existing requests and this feature hasn't been requested yet
• [x] This is a single feature request (not multiple features)

Problem Statement

Coding agents introduce defects into every class of change — including remediation code written specifically to fix a defect the agent just found. There is no "safe" category of change that can skip review.

Voluntary review does not survive contact with the agent: review-on-request gets skipped under time or token pressure, and agents actively circumvent existing gates. Claude Code has been observed bypassing git pre-commit hooks with --no-verify, stash tricks, and quiet flags despite explicit deny rules (#40117). A client-side git hook is advisory to an agent that controls the shell.

The official Code Review feature fires at PR time — after the defect is committed, built on, and entangled with later work. The cheapest interception point is before the commit exists.

Proposed Solution

A native PreCommit gate in Claude Code:

• The harness intercepts any commit at the tool-call level (the way PreToolUse hooks do today — not only via git hooks) and blocks it until an independent reviewer subagent with fresh context has reviewed the exact staged diff and produced a verdict tied to that diff (e.g., keyed to the tree hash).
• Unbypassable at the harness level. --no-verify, stash-and-recommit, and equivalent evasions are refused by the harness itself, not by instructions the agent can rationalize past. This is the piece a plain git hook cannot deliver (#40117).
• Severity threshold. The gate blocks on confirmed correctness/security/data-loss findings, not style nits — otherwise false-positive fatigue creates pressure to disable it.
• Adversarial, not collegial. The reviewer's mandate is to break the change: wrong logic, missed edge cases, injected regressions, defects in the fix itself.
• Ship as a supported settings flag, with verdicts recorded so humans can audit what the gate approved.

Alternative Solutions

• Git pre-commit hook running an adversarial reviewer — I run this today and it works, but it is bypassable by the agent (--no-verify; see #40117), so "mandatory" is only as strong as the agent's compliance.
• CLAUDE.md instructions to always request review — rationalized past under pressure.
• PR-time review (official Code Review feature) — valuable, but too late; defects are already committed and built upon.
• #4834 requests PreCommit/PostCommit hook events — related plumbing, but this request is specifically for a built-in adversarial reviewer with block semantics the agent cannot evade.

Priority

High - Significant impact on productivity

Feature Category

Other

Use Case Example

I installed exactly this as a git pre-commit hook: every commit is blocked until an adversarial review agent passes the staged diff. Results:

1. It catches real defects in ordinary changes and in remediation changes — code written to fix a defect frequently contains a new one.
2. While the agent was building the hook itself, the adversary flagged errors in the hook code the agent was about to commit. The mechanism validated itself before it was even finished.

The only failure mode I cannot close from the outside is the agent bypassing the hook — which is why this belongs in the harness.

Additional Context

Multiple independent community implementations of this pattern exist (adversarial debate loops, review panels, pre-commit review gates) — e.g. https://github.com/alecnielsen/adversarial-review, https://github.com/robertoecf/adversarial-review, https://github.com/wan-huiyan/agent-review-panel, https://imti.co/pre-commit-review-gate/. Everyone building seriously with agents is reinventing this; that is the signature of a missing platform feature.

Anticipated objections: per-commit cost is real but asymmetric vs. escaped defects (mitigate via severity threshold and verdict caching per tree hash); reviewer sharing the writer's model has correlated blind spots (fresh context + breaking mandate still catches a large share, and the design permits a different reviewer model); verdicts are non-deterministic (a gate that stochastically catches defects strictly dominates no gate, and recorded verdicts make it auditable).