Cross-vendor review

scripts/cross-review (on PATH as cross-review) freezes HEAD in a throwaway worktree, sends the diff with the task brief to a reviewer from another vendor, checks the JSON it returns, and prints ranked findings. Because it reviews the frozen copy, you can keep working while it runs.

1. Decide whether to review

Review once per change, not per commit. Skip the review when the change is only:

• docs, comments, copy or formatting;
• generated files, or a dependency bump whose CI lane proves it;
• under ~15 changed lines of plain logic, with a test that shows it works.

Always review, however small, a change that touches concurrency, persistence or migrations, secrets or auth, parsing of untrusted input, process spawning, trust boundaries or invariants the repo documents, or that deletes or weakens a validation or a test assertion.