PR Guardian — four Bob specialists, one report

THE PROBLEM In most teams a pull request waits longer for review than it took to write. When the review finally happens it is done by one person who is context-switching, tired, and expected to be a security engineer, a performance engineer, a test engineer and the keeper of the team's conventions - all at once, at 6 p.m. Review fatigue is how SQL injections, missing auth checks and N+1 queries reach production. THE SOLUTION PR Guardian turns IBM Bob into a review team. It is a portable .bob/ configuration - a custom mode, a skill, four specialist checklists and two slash commands - that works in any repository you open in Bob IDE. You check out the branch and type /pr-review main: 1. Bob captures the change set (git diff against the base branch). 2. It spawns four specialist subagents in the same turn, so they run in parallel, each in an isolated context with a focused checklist: Security, Performance, Test Coverage, and Style & Architecture. The last one reads the repository's AGENTS.md, so it enforces this team's own conventions rather than generic taste. 3. The orchestrator merges the four summaries, de-duplicates by file and line, ranks every finding Critical / Warning / Suggestion, computes a verdict (BLOCK, NEEDS CHANGES or APPROVE WITH COMMENTS) and writes reports/PR_GUARDIAN_REPORT.md, opening with a Reviewer Brief: the three places a human should look first. The mode is deliberately read-only on source code - its edit permission is restricted to reports/ - so it is safe to run on any branch. Fixing is a separate, explicit step: /pr-guardian-fix in Agent mode applies the Critical fixes and writes the missing tests. TARGET USERS Engineering teams that review PRs; the human keeps the final decision, PR Guardian does the first, exhausting pass. RESULTS We built TaskFlow, a small Flask + SQLite API with written conventions, and opened a realistic PR that plants 12 defects (4 security, 4 performance, 1 test gap, 3 style/architecture). The answer key is hidden from Bob via .bobignore. PR Guardian caught 12 of 12, including all four Criticals (SQL injection, hard-coded secret, unauthenticated admin endpoint, IDOR), with 8 exact severity matches and 4 over-escalations (the safe direction). The four specialists finished in 42 seconds of wall-clock time (141 seconds of specialist work, run in parallel) for about one Bobcoin per review. The follow-up /pr-guardian-fix run repaired all Criticals and generated 19 tests (28 passing). BUSINESS VALUE The reviewer starts from a ranked brief instead of a cold diff; Critical issues surface in minutes, not days; a review costs a fraction of one missed injection. Adoption is copying a folder - no CI changes, no infrastructure. Because conventions live in AGENTS.md, the review improves every time the team writes a rule down. WHY NOT JUST /review? Bob's built-in review is one generalist pass. PR Guardian is a team of specialists with isolated attention, a file-based severity policy, repo-convention awareness, a sandboxed orchestrator and a reproducible benchmark.