review: read and output budget on the small-diff fast path

.claude/skills/deep-code-review/SKILL.md

@@ -21,4 +21,6 @@ You are a senior reviewer hunting defects that a change introduces. For a small
 4. One finding per distinct mechanism, most severe first, at most 8.
 5. Guarantees: for each guarantee-bearing comment, docstring or UI string in the diff (never, always, exactly once, consent enforced), name the test that forces the adversarial case it denies; an unpinned guarantee is a finding, High if it guards privacy, consent, money or data.
 
+BUDGET (small DIFF): `git diff --stat -p` is the one patch read; grep the callers and callees of each changed symbol and Read those ranges, and the context around each hunk, with offset/limit; read a whole file only if under ~200 lines; pipe test and CI output through `tail -n 40`; no narration between tool calls. This never skips a security check above.
+
 OUTPUT. Final message: the severity-ranked findings, each as `file:line`, severity, mechanism and failing input in one or two sentences. Report template: `references/full-map-report.md`.

.claude/skills/deep-code-review/evals/evals.json

@@ -8316,6 +8316,18 @@
         "States that a routing match skips INDEX.md",
         "Does not read INDEX.md before the full-map.md routing"
       ]
+    },
+    {
+      "id": "small-diff-read-budget",
+      "prompt": "Review a 120-line diff across three files. How do you read and run things?",
+      "expected_output": "Runs the diff stat first, locates with grep, Reads with offset/limit around each hunk (whole file only if under ~200 lines), pipes test/CI output through tail -n 40, no narration between tool calls; security checks unchanged.",
+      "expectations": [
+        "Runs git diff --stat before reading per-file diffs",
+        "Uses grep then Read with offset/limit around hunks, no whole-file read of files over ~200 lines",
+        "Pipes test and CI output through tail -n 40",
+        "Emits no narration between tool calls",
+        "Does not skip any security check to save tokens"
+      ]
     }
   ]
 }

changelog.d/review-read-budget.md

@@ -0,0 +1,2 @@
+### Changed
+- `deep-code-review` small-diff fast path gains a one-line read/output budget: `git diff --stat` first, grep to locate then Read with offset/limit around each hunk (whole file only under ~200 lines), test and CI output through `tail -n 40`, no narration between tool calls. Targets Read results and Bash output, the two largest review-cost shares; the security checks are unchanged. Pinned by `scripts/test_review_read_budget.py` and the `small-diff-read-budget` eval.

scripts/test_review_read_budget.py

@@ -0,0 +1,23 @@
+"""The small-diff fast path in SKILL.md carries the read/output budget rule and keeps the security floor."""
+import re
+import unittest
+from pathlib import Path
+
+SKILL = Path(__file__).resolve().parent.parent / ".claude/skills/deep-code-review/SKILL.md"
+
+
+class ReadBudget(unittest.TestCase):
+    def test_rule_in_fast_path(self):
+        s = SKILL.read_text()
+        m = re.search(r"^BUDGET \(small DIFF\):.*$", s, re.M)
+        self.assertTrue(m, "BUDGET line missing")
+        for needle in ("git diff --stat -p", "grep", "callers", "offset/limit", "~200 lines", "tail -n 40", "no narration"):
+            self.assertIn(needle, m.group(0))
+        self.assertLess(m.start(), s.index("\nOUTPUT."), "rule must sit in the fast path")
+        self.assertIn("never skips a security check", m.group(0))
+        self.assertRegex(s, r"(?m)^1\. Read every hunk")
+        self.assertRegex(s, r"(?m)^5\. Guarantees:")
+
+
+if __name__ == "__main__":
+    unittest.main()