security-guidance: never report a failed review as clean

[mhegazy]

Human: @mhegazy

Summary

A review that got no answer was reported as clean (anthropics/claude-code#99840, also anthropics/claude-code#81057). When the model call failed, or its reply could not be read, the commit review logged "no security issues found" and marked the commit reviewed, so the push review skipped it.

What changes

• A commit whose review got no verdict is not marked reviewed, so a later push review from Claude Code still checks it, unless the same command pushed it. No verdict means an API error, an unexpected error in the call, or a reply that cannot be read or lacks the verdict flag. A failed push review does not mark its range either.
• Claude is told once per session for each kind of review (commit or push) and each kind of failure, for example "Commit security review did not complete: the API rejected the plugin's credentials (HTTP 401). Log: ". Later failures of the same kind are only logged. Nothing is blocked: the commit has already happened when the review runs.
• In the agentic race, a single-shot fallback that got no verdict no longer wins while the agentic review can still answer. It waits up to 8 minutes from the start of the review. The fallback no longer starts after the agentic review has answered, and it never runs twice.
• The Stop review uses the same signal, so an unreadable reply no longer records the diff as reviewed.

No version bump here. A separate PR bumps the plugin to 2.0.14 and should merge after this one.

Trade-offs

• When a push review fails, or a commit review fails in a command that also pushed, a later push does not re-check those commits, because the pushed range has moved on. The notice says so.
• A Stop review whose reply stays unreadable is retried on later turns with the growing diff, where it used to be recorded as reviewed.

Test plan

New tests/test_review_outcomes.py, 26 tests. Without the fix 25 of them fail. The plugin's suite passes, 214 tests, under pytest on Linux.

End to end. Run in tmux with public Claude Code 2.1.292, the plugin loaded by --plugin-dir, against a local fake API that scripts Claude and answers the plugin's review calls. The endpoint answers the plugin's review call with 401. Claude writes a file with a shell-injection bug and commits it.

	Before (main)	After
Commit recorded as reviewed	Yes	No
What Claude was told	Nothing	"The security review of this commit did not complete: the API rejected the plugin's credentials (HTTP 401)…"

Not verified: macOS and Windows.

---

Generated by Claude Code