One systemd daemon watches GitHub and Gitea and routes each PR to an aoe
session: `land` for PRs you authored, `review-pr` for everyone else's.
It reads metadata only and sends a single inert hint line, so untrusted
PR text never passes through the thing that types into agent prompts.
Routing is derived from `aoe list --json --all` by worktree branch, so
no claim files and no daemon database. Dedupe stays in the session via
`pr-<N>-seen`, which makes hints idempotent and a swallowed send
self-healing.
`land` loses its watcher machinery to the daemon and keeps the policy
and per-event handlers; `pr-common` holds what both skills share.
Review sessions run non-yolo without trusted hooks and never run the
branch's code.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Miguel Palhas
787f133fdc