AUR-502: team-defined reviewer profiles and multi-agent review

Outcome

The team declares its own reviewer profiles in a versioned repository file, .aurumcode/profiles.yml, and can run more than one profile in the same review. Findings from every profile merge deterministically, each one naming the profile that produced it, and the output declares which profiles entered. Profiles remain presets over review emphasis and enabled rule families.

Contract

AC-001 Team definition

.aurumcode/profiles.yml is a profiles: sequence. Each entry declares:

profiles:
  - name: release
    version: "2"                # optional, defaults to "1"
    emphasis: upstream compatibility
    families: [quality, performance]
    instructions: Confira contrato e custo de rollout.

A missing file is the zero-config case. A file that exists must fail closed: an entry without a name, without emphasis/families/instructions, a repeated name, a name that shadows a built-in, or an unknown key is an error naming the problem. A selected name that resolves to neither a built-in nor a team profile is ErrUnknownProfile, returned before any model call.

AC-002 Multi-agent

ResolveAll(Selection{Names: [...]}, team) resolves every name in order and declares them. Findings are represented by reviewprofile.Finding; each carry a Profile. MergeFindings collapses duplicates to the first profile in declaration order, keeps the source profile on every finding, and sorts by a stable content key (file, line, rule, message), so the same input always yields the same bytes.

At the CLI seam, --perfis a,b (or its --profile single alias) selects profiles for aurumcode review --base; the repository review.profiles list is the default and the flag wins. When more than one profile is selected each profile gets its own model pass, with its emphasis and instructions prepended to the prompt, and the findings merge. --perfis/--profile are refused with --pr rather than silently ignored.

AC-003 Frontier

A profile -- built-in or team -- can never change finding severity, relax --fail-on, disable secret redaction, change the cost cap or disable the deterministic security pass. Compile/LoadTeam refuse a definition that names any such clause (ErrRefusedClause, naming the clause), including through YAML merge keys and aliases, using the same fail-closed raw scan AUR-500 introduced. The cost tracker is shared across profile passes, so adding a profile cannot raise the ceiling, and the security pass still runs after the model.

AC-004 Compatibility

No team file, no review.profiles, no flag: behavior is byte-for-byte AUR-500/today. A single selected profile resolves to the exact same Profile.Signature() AUR-500's Resolve produced. product_owner joins solid, seguranca and performance as a built-in.

Non-goals

Remote or downloaded profiles, executable profile plugins, and any profile that changes the severity vocabulary (AUR-471).

Validation

bash tests/acceptance/AUR-502.sh all

Selectors: all, AC-001, AC-002, AC-003, AC-004, MUT-001, MUT-002. An unknown selector exits 64; a missing Go runtime exits 79.

MUT-001 ignores the selection and always adds profiles (AC-002/AC-004 go RED). MUT-002 neutralizes the raw clause scan so a team profile can disable a boundary (AC-003 goes RED).