diff --git a/.opencode/command/code-review-graph-project-review.md b/.opencode/command/code-review-graph-project-review.md
new file mode 100644
index 0000000..eb94c75
--- /dev/null
+++ b/.opencode/command/code-review-graph-project-review.md
@@ -0,0 +1,42 @@
+---
+description: Whole-project or single-feature code review (not diff-based) using graph-wide analysis and objective scoring.
+agent: build
+---
+
+# Project Review
+
+Review the entire codebase or a single feature/module, independent of the git diff. The scope is driven by your instruction.
+
+$ARGUMENTS
+
+**Token optimization:** Before starting, call `get_docs_section_tool(section_name="project-review")` for the optimized workflow.
+
+## Steps
+
+1. **Parse the scope** from the user instruction:
+   - "对项目代码进行全面审查" / "全面审查" / "整个项目" → `scope=whole-project`
+   - "审查 <功能/模块> 的代码" (e.g. payment, auth) → `scope=feature`, target=<keyword>
+
+2. **Ensure the graph is current** by calling `build_or_update_graph_tool()`.
+
+3. **Map the architecture** by calling `get_architecture_overview_tool(detail_level="minimal")` and `list_communities_tool(detail_level="minimal")`.
+
+4. **Scan high-risk areas** (whole-project): `get_knowledge_gaps_tool()`, `get_hub_nodes_tool()`, `get_bridge_nodes_tool()`, `find_large_functions_tool()`, `get_surprising_connections_tool()`.
+
+5. **Score objectively**:
+   - whole-project: `score_review_tool(all_files=True)` — every source file in the graph
+   - feature: `semantic_search_nodes_tool(query=<target>)` + `query_graph_tool(pattern="children_of", target=<target>)` to locate files, then `score_review_tool(changed_files=<files>)` + `get_impact_radius_tool(changed_files=<files>)`
+
+6. **Review the code** (Layer 1 chain decomposition): eight categories + gstack CRITICAL sub-pass. Produce findings with severity (blocker/major/minor), confidence (1-10), file:line, and proposed fix.
+
+7. **Merge findings** by calling `dedupe_findings_tool(findings=<your findings>)`.
+
+8. **Generate the report** by calling `generate_report_tool(review_data=<verdict, scope, metrics, merged findings>)` — writes `code-review-report.html` and `code-review-report.md` (default `format="both"`).
+
+9. **Report** the verdict (✅ PASS / ❌ FAIL), severity counts, each issue with confidence + fix, and manual-review items.
+
+## Important Rules
+
+- **READ-ONLY.** This workflow never modifies code, commits, or pushes. Every finding waits for a manual fix decision.
+- **Any blocker → verdict ❌ FAIL**, regardless of other scores.
+- This is **not** a diff review. For diff-based review use `/code-review-graph-unified-review`.
diff --git a/.opencode/command/code-review-graph-unified-review.md b/.opencode/command/code-review-graph-unified-review.md
index ab70525..2e7f52f 100644
--- a/.opencode/command/code-review-graph-unified-review.md
+++ b/.opencode/command/code-review-graph-unified-review.md
@@ -27,7 +27,7 @@ $ARGUMENTS
 
 7. **Merge findings** by calling `dedupe_findings_tool(findings=<your findings>)` — fingerprint dedup, multi-source confidence boost, PR quality score.
 
-8. **Generate the report** by calling `generate_report_tool(review_data=<verdict, tier, scope, metrics, merged findings>)` — writes `code-review-report.html`.
+8. **Generate the report** by calling `generate_report_tool(review_data=<verdict, tier, scope, metrics, merged findings>)` — writes `code-review-report.html` and `code-review-report.md` (default `format="both"`).
 
 9. **Report** the verdict (✅ PASS / ❌ FAIL), severity counts, each issue with confidence + fix, and manual-review items.
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 530b6a9..f2ee048 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,6 +14,15 @@
   `dedupe_findings_tool` (fingerprint dedup, multi-source confidence boost,
   PR quality score), and `generate_report_tool` (standalone
   `code-review-report.html`). See `code_review_graph/scoring.py`.
+- Added the **project-review** workflow for whole-project or single-feature
+  code review independent of the git diff.  Scope is parsed from the user
+  instruction (全面/整个项目 → whole-project; otherwise feature + target
+  keyword).  `score_review_tool` gained an `all_files` parameter that scores
+  every source file in the graph.  Ships as a skill, an MCP prompt
+  (`project_review`), and the `/code-review-graph:project-review` command.
+- Added a Chinese Markdown review report alongside the HTML one;
+  `generate_report_tool` defaults to `format="both"` writing
+  `code-review-report.html` + `code-review-report.md`.
 
 - Added a Voyage AI embedding provider (`--provider voyage`, key from
   `VOYAGE_API_KEY`, opt-in request throttling via
diff --git a/CLAUDE.md b/CLAUDE.md
index 5dc62dd..274c23c 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -19,7 +19,7 @@ When using code-review-graph MCP tools, follow these rules:
   - `custom_languages.py` — Config-driven custom language support (`.code-review-graph/languages.toml`, see docs/CUSTOM_LANGUAGES.md)
   - `graph.py` — SQLite-backed graph store (nodes, edges, weighted-score impact analysis)
   - `tools/` — 31 MCP tool implementations split by domain
-  - `main.py` — FastMCP server entry point, registers 31 tools + 6 prompts
+  - `main.py` — FastMCP server entry point, registers 31 tools + 7 prompts
   - `incremental.py` — Git-based change detection, file watching
   - `embeddings.py` — Optional vector embeddings (local sentence-transformers, OpenAI-compatible endpoints, Google Gemini, MiniMax)
   - `visualization.py` — D3.js interactive HTML graph generator
@@ -30,7 +30,7 @@ When using code-review-graph MCP tools, follow these rules:
   - `changes.py` — Risk-scored change impact analysis (detect-changes)
   - `refactor.py` — Rename preview, dead code detection, refactoring suggestions
   - `hints.py` — Review hint generation
-  - `prompts.py` — 6 MCP prompt templates (review_changes, architecture_map, debug_issue, onboard_developer, pre_merge_check, unified_review)
+  - `prompts.py` — 7 MCP prompt templates (review_changes, architecture_map, debug_issue, onboard_developer, pre_merge_check, unified_review, project_review)
   - `wiki.py` — Markdown wiki generation from community structure
   - `skills.py` — Multi-platform install/config generation and shipped skill metadata
   - `registry.py` — Multi-repo registry helpers
diff --git a/README.hi-IN.md b/README.hi-IN.md
index 303b155..e4d0d10 100644
--- a/README.hi-IN.md
+++ b/README.hi-IN.md
@@ -253,8 +253,8 @@ code-review-graph serve            # MCP सर्वर शुरू करे
 | `list_repos_tool` | रजिस्टर्ड रिपॉज़िटरीज़ की सूची |
 | `cross_repo_search_tool` | सभी रजिस्टर्ड रिपॉज़िटरीज़ में सर्च करें |
 
-**MCP प्रॉम्प्ट्स** (6 वर्कफ़्लो टेम्प्लेट):
-`review_changes`, `architecture_map`, `debug_issue`, `onboard_developer`, `pre_merge_check`, `unified_review`
+**MCP प्रॉम्प्ट्स** (7 वर्कफ़्लो टेम्प्लेट):
+`review_changes`, `architecture_map`, `debug_issue`, `onboard_developer`, `pre_merge_check`, `unified_review`, `project_review`
 
 </details>
 
diff --git a/README.ja-JP.md b/README.ja-JP.md
index d036d88..f7de0cf 100644
--- a/README.ja-JP.md
+++ b/README.ja-JP.md
@@ -255,8 +255,8 @@ code-review-graph serve            # MCPサーバーの起動
 | `list_repos_tool` | 登録済みリポジトリの一覧 |
 | `cross_repo_search_tool` | 全登録リポジトリを横断検索 |
 
-**MCPプロンプト**（6つのワークフローテンプレート）：
-`review_changes`, `architecture_map`, `debug_issue`, `onboard_developer`, `pre_merge_check`, `unified_review`
+**MCPプロンプト**（7つのワークフローテンプレート）：
+`review_changes`, `architecture_map`, `debug_issue`, `onboard_developer`, `pre_merge_check`, `unified_review`, `project_review`
 
 </details>
 
diff --git a/README.ko-KR.md b/README.ko-KR.md
index 62bb4c9..0748778 100644
--- a/README.ko-KR.md
+++ b/README.ko-KR.md
@@ -255,8 +255,8 @@ code-review-graph serve            # MCP 서버 시작
 | `list_repos_tool` | 등록된 저장소 목록 |
 | `cross_repo_search_tool` | 등록된 모든 저장소에서 검색 |
 
-**MCP 프롬프트** (6개 워크플로 템플릿):
-`review_changes`, `architecture_map`, `debug_issue`, `onboard_developer`, `pre_merge_check`, `unified_review`
+**MCP 프롬프트** (7개 워크플로 템플릿):
+`review_changes`, `architecture_map`, `debug_issue`, `onboard_developer`, `pre_merge_check`, `unified_review`, `project_review`
 
 </details>
 
diff --git a/README.md b/README.md
index c755e83..5ef93ad 100644
--- a/README.md
+++ b/README.md
@@ -321,7 +321,7 @@ The benchmark also runs an honest **co-change mode**: the predictor is seeded wi
 | **Wiki generation** | Auto-generate markdown wiki from community structure |
 | **Multi-repo registry** | Register multiple repos, search across all of them |
 | **Multi-repo daemon** | `crg-daemon` watches multiple repos as child processes, with health checks and auto-restart |
-| **MCP prompts** | 6 workflow templates: review, architecture, debug, onboard, pre-merge, unified-review |
+| **MCP prompts** | 7 workflow templates: review, architecture, debug, onboard, pre-merge, unified-review, project-review |
 | **Full-text search** | FTS5-powered hybrid search combining keyword and vector similarity |
 | **Local storage** | SQLite file in `.code-review-graph/`. Core graph storage needs no external database or cloud service. |
 | **Watch mode** | Continuous graph updates as you work |
@@ -501,10 +501,10 @@ Your AI assistant uses these automatically once the graph is built.
 | `cross_repo_search_tool` | Search across all registered repositories |
 | `score_review_tool` | Objective Layer-2 review metrics (good/warn/fail grades) |
 | `dedupe_findings_tool` | Fingerprint dedup + multi-source confidence merge |
-| `generate_report_tool` | Render the standalone HTML code review report |
+| `generate_report_tool` | Render the HTML and/or Markdown review report |
 
-**MCP Prompts** (6 workflow templates):
-`review_changes`, `architecture_map`, `debug_issue`, `onboard_developer`, `pre_merge_check`, `unified_review`
+**MCP Prompts** (7 workflow templates):
+`review_changes`, `architecture_map`, `debug_issue`, `onboard_developer`, `pre_merge_check`, `unified_review`, `project_review`
 
 </details>
 
diff --git a/README.zh-CN.md b/README.zh-CN.md
index 84eb60f..3b8b53f 100644
--- a/README.zh-CN.md
+++ b/README.zh-CN.md
@@ -253,8 +253,8 @@ code-review-graph serve            # 启动 MCP 服务器
 | `list_repos_tool` | 列出已注册的仓库 |
 | `cross_repo_search_tool` | 跨所有注册仓库搜索 |
 
-**MCP 提示模板**（6 种工作流模板）：
-`review_changes`、`architecture_map`、`debug_issue`、`onboard_developer`、`pre_merge_check`、`unified_review`
+**MCP 提示模板**（7 种工作流模板）：
+`review_changes`、`architecture_map`、`debug_issue`、`onboard_developer`、`pre_merge_check`、`unified_review`、`project_review`
 
 </details>
 
diff --git a/code_review_graph/assets/report-template.html b/code_review_graph/assets/report-template.html
index 696dadb..bd2bf45 100644
--- a/code_review_graph/assets/report-template.html
+++ b/code_review_graph/assets/report-template.html
@@ -1,9 +1,9 @@
 <!DOCTYPE html>
-<html lang="en">
+<html lang="zh-CN">
 <head>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
-<title>Code Review Report</title>
+<title>代码审查报告</title>
 <style>
   :root { --border:#d0d7de; --bg:#f6f8fa; --fg:#1f2328; --muted:#57606a;
           --good:#1a7f37; --warn:#9a6700; --fail:#cf222e; --na:#57606a;
@@ -61,28 +61,45 @@ function verdictClass(v) {
   return v.includes("PASS") ? "pass" : "fail";
 }
 
-let html = `<h1>Code Review Report</h1>
+const metricLabels = {
+  sql_risk: "SQL 注入风险",
+  exception_coverage: "异常分支覆盖",
+  redundancy_rate: "代码冗余率",
+  high_risk_density: "高风险场景密度",
+  vulnerability_risk: "漏洞风险",
+};
+const gradeLabels = { good: "良好", warn: "警告", fail: "不合格", na: "不适用" };
+const sevLabels = {
+  blocker: "🔴 阻塞", critical: "🔴 严重",
+  major: "🟡 主要", warn: "🟡 主要",
+  minor: "🔵 次要", informational: "🔵 次要",
+};
+
+let html = `<h1>代码审查报告</h1>
 <div class="meta">
-  <span class="verdict ${verdictClass(data.verdict)}">${esc(data.verdict || "NO VERDICT")}</span>
-  &nbsp; Tier: <code>${esc(data.tier || "standard")}</code>
-  &nbsp; Scope: <code>${esc(data.scope || "change-level")}</code>
-  ${data.baseline ? `&nbsp; Baseline: <code>${esc(data.baseline)}</code>` : ""}
+  <span class="verdict ${verdictClass(data.verdict)}">${esc(data.verdict || "无结论")}</span>
+  &nbsp; 档位: <code>${esc(data.tier || "standard")}</code>
+  &nbsp; 范围: <code>${esc(data.scope || "change-level")}</code>
+  ${data.baseline ? `&nbsp; 基线: <code>${esc(data.baseline)}</code>` : ""}
 </div>`;
-if (data.timestamp) html += `<p class="muted">Generated ${esc(data.timestamp)}</p>`;
-if (data.files) html += `<p><b>Files:</b> ${esc(data.files)}</p>`;
+if (data.quality_score != null) html += `<p><b>PR 质量分:</b> ${esc(data.quality_score)}/10</p>`;
+if (data.timestamp) html += `<p class="muted">生成时间: ${esc(data.timestamp)}</p>`;
+if (data.files) html += `<p><b>文件:</b> ${esc(data.files)}</p>`;
 if (data.summary) html += `<p>${esc(data.summary)}</p>`;
 
 const metrics = data.metrics || {};
 const mkeys = Object.keys(metrics);
 if (mkeys.length) {
-  html += `<h2>Objective Metrics</h2><table><tr><th>Metric</th><th>Value</th><th>Grade</th><th>Notes</th></tr>`;
+  html += `<h2>客观指标</h2><table><tr><th>指标</th><th>数值</th><th>评级</th><th>说明</th></tr>`;
   for (const k of mkeys) {
     const m = metrics[k] || {};
     const g = m.grade || "na";
+    const label = metricLabels[k] || k;
+    const gradeText = gradeLabels[g] || g;
     html += `<tr>
-      <td>${esc(k)}</td>
+      <td>${esc(label)}</td>
       <td>${esc(m.value ?? "N/A")}</td>
-      <td class="grade ${esc(g)}">${esc(g)}</td>
+      <td class="grade ${esc(g)}">${esc(gradeText)}</td>
       <td class="muted">${esc(m.note || "")}</td>
     </tr>`;
   }
@@ -90,32 +107,33 @@ if (mkeys.length) {
 }
 
 const issues = data.issues || [];
-html += `<h2>Issues (${issues.length})</h2>`;
+html += `<h2>问题清单 (${issues.length})</h2>`;
 if (!issues.length) {
-  html += `<p class="muted">No issues found.</p>`;
+  html += `<p class="muted">未发现问题。</p>`;
 }
 for (const i of issues) {
   const sev = (i.severity || "minor").toLowerCase();
+  const sevLabel = sevLabels[sev] || i.severity;
   html += `<div class="issue">
-    <span class="tag ${esc(sev)}">${esc(i.severity)}</span>
+    <span class="tag ${esc(sev)}">${esc(sevLabel)}</span>
     <span class="cat">${esc(i.category)}</span>
     ${esc(i.message || "")}
-    ${i.confidence ? `<span class="muted">(confidence ${esc(i.confidence)})</span>` : ""}
+    ${i.confidence != null ? `<span class="muted">(置信度 ${esc(i.confidence)}/10)</span>` : ""}
     ${i.location ? `<div class="loc">→ ${esc(i.location)}</div>` : ""}
-    ${i.fix ? `<div class="fix"><b>Fix:</b> ${esc(i.fix)}</div>` : ""}
+    ${i.fix ? `<div class="fix"><b>修复建议:</b> ${esc(i.fix)}</div>` : ""}
   </div>`;
 }
 
 const manual = data.manual_review || [];
 if (manual.length) {
-  html += `<h2>Manual Review Required</h2><ul>`;
+  html += `<h2>需要人工审查</h2><ul>`;
   for (const m of manual) html += `<li>${esc(m)}</li>`;
   html += `</ul>`;
 }
 
 const judged = data.llm_judged || [];
 if (judged.length) {
-  html += `<p class="muted"><b>LLM-judged:</b> ${judged.map(esc).join(", ")}</p>`;
+  html += `<p class="muted"><b>需 LLM 判断的指标:</b> ${judged.map(esc).join(", ")}</p>`;
 }
 
 document.getElementById("app").innerHTML = html;
diff --git a/code_review_graph/docs/LLM-OPTIMIZED-REFERENCE.md b/code_review_graph/docs/LLM-OPTIMIZED-REFERENCE.md
index 22929dd..086c83d 100644
--- a/code_review_graph/docs/LLM-OPTIMIZED-REFERENCE.md
+++ b/code_review_graph/docs/LLM-OPTIMIZED-REFERENCE.md
@@ -25,18 +25,22 @@ Never include full files unless explicitly asked.
 </section>
 
 <section name="unified-review">
-Full three-layer review: 1) get_minimal_context_tool + build_or_update_graph_tool + get_review_context_tool + detect_changes_tool for graph context; 2) Layer-1 chain decomposition across 8 categories + gstack CRITICAL sub-pass; 3) score_review_tool for objective Layer-2 metrics; 4) specialist subagents (diff >= 50 lines); 5) dedupe_findings_tool to merge; 6) READ-ONLY manual adjudication per severity; 7) generate_report_tool to write code-review-report.html. Read .code-review.yaml for tier (fast/standard/strict). Target: <=8 tool calls, <=1200 tokens.
+Full three-layer review: 1) get_minimal_context_tool + build_or_update_graph_tool + get_review_context_tool + detect_changes_tool for graph context; 2) Layer-1 chain decomposition across 8 categories + gstack CRITICAL sub-pass; 3) score_review_tool for objective Layer-2 metrics; 4) specialist subagents (diff >= 50 lines); 5) dedupe_findings_tool to merge; 6) READ-ONLY manual adjudication per severity; 7) generate_report_tool to write code-review-report.html + code-review-report.md. Read .code-review.yaml for tier (fast/standard/strict). Target: <=8 tool calls, <=1200 tokens.
+</section>
+
+<section name="project-review">
+Whole-project or feature review (not diff-based): 1) get_minimal_context_tool + build_or_update_graph_tool; 2) get_architecture_overview_tool + list_communities_tool for the module map; 3) get_knowledge_gaps_tool + get_hub_nodes_tool + get_bridge_nodes_tool + find_large_functions_tool + get_surprising_connections_tool for high-risk areas; 4) whole-project: score_review_tool(all_files=True); feature: semantic_search_nodes_tool + query_graph_tool(children_of) to locate files, then score_review_tool(changed_files) + get_impact_radius_tool; 5) dedupe_findings_tool; 6) READ-ONLY adjudication; 7) generate_report_tool (format=both). Parse scope from the user instruction (全面/整个项目 -> whole-project, else feature + target). Target: <=12 tool calls, <=1800 tokens.
 </section>
 
 <section name="score-review">
-score_review_tool returns objective metrics (sql_risk, exception_coverage, redundancy_rate, high_risk_density, vulnerability_risk) with good/warn/fail grades + llm_judged list. dedupe_findings_tool merges findings by path:line:category fingerprint, boosts multi-source confidence (+1 cap 10), computes PR quality score. generate_report_tool writes the standalone HTML report.
+score_review_tool returns objective metrics (sql_risk, exception_coverage, redundancy_rate, high_risk_density, vulnerability_risk) with good/warn/fail grades + llm_judged list. Pass all_files=True to score every source file (whole-project review). dedupe_findings_tool merges findings by path:line:category fingerprint, boosts multi-source confidence (+1 cap 10), computes PR quality score. generate_report_tool writes the HTML and/or Markdown review report (format=both by default).
 </section>
 
 <section name="commands">
 Core MCP tools: get_minimal_context_tool, detect_changes_tool, get_review_context_tool, get_impact_radius_tool, query_graph_tool, semantic_search_nodes_tool, get_architecture_overview_tool, get_affected_flows_tool, list_flows_tool, list_communities_tool, refactor_tool, build_or_update_graph_tool, run_postprocess_tool, embed_graph_tool, list_graph_stats_tool, get_docs_section_tool
 Unified-review MCP tools: score_review_tool, dedupe_findings_tool, generate_report_tool
-MCP prompts (6): review_changes, architecture_map, debug_issue, onboard_developer, pre_merge_check, unified_review
-Skills: build-graph, debug-issue, explore-codebase, refactor-safely, review-changes, review-delta, review-pr, unified-review
+MCP prompts (7): review_changes, architecture_map, debug_issue, onboard_developer, pre_merge_check, unified_review, project_review
+Skills: build-graph, debug-issue, explore-codebase, refactor-safely, review-changes, review-delta, review-pr, unified-review, project-review
 CLI: code-review-graph [install|init|build|update|status|watch|visualize|serve|mcp|wiki|detect-changes|postprocess|embed|register|unregister|repos|eval|daemon]
 Token efficiency: Prefer detail_level="minimal" where available. Always call get_minimal_context_tool first. Some review/context tools return compact estimated context_savings metadata.
 </section>
diff --git a/code_review_graph/main.py b/code_review_graph/main.py
index 0f2b518..38657c5 100644
--- a/code_review_graph/main.py
+++ b/code_review_graph/main.py
@@ -27,6 +27,7 @@ from .prompts import (
     debug_issue_prompt,
     onboard_developer_prompt,
     pre_merge_check_prompt,
+    project_review_prompt,
     review_changes_prompt,
     unified_review_prompt,
 )
@@ -697,6 +698,7 @@ async def score_review_tool(
     include_churn: bool = True,
     repo_root: Optional[str] = None,
     detail_level: str = "standard",
+    all_files: bool = False,
 ) -> dict:
     """Compute objective Layer-2 review metrics for changed files.
 
@@ -717,6 +719,9 @@ async def score_review_tool(
         repo_root: Repository root path. Auto-detected if omitted.
         detail_level: "standard" for full output, "minimal" for
             token-efficient summary. Default: standard.
+        all_files: When True, score every source file in the graph,
+            ignoring ``changed_files`` and the git diff.  Used for
+            whole-project reviews (default: False).
     """
     root = _resolve_repo_root(repo_root)
 
@@ -724,7 +729,7 @@ async def score_review_tool(
         return with_provenance(score_review_func(
             changed_files=changed_files, base=base,
             include_churn=include_churn, repo_root=root,
-            detail_level=detail_level,
+            detail_level=detail_level, all_files=all_files,
         ), root)
 
     return await asyncio.to_thread(_run)
@@ -763,30 +768,34 @@ async def generate_report_tool(
     review_data: dict,
     output_path: Optional[str] = None,
     repo_root: Optional[str] = None,
+    format: str = "both",
 ) -> dict:
-    """Generate a self-contained HTML code review report.
+    """Generate code review reports (HTML and/or Markdown).
 
     Injects ``review_data`` (output of ``score_review_tool`` plus
     ``dedupe_findings_tool`` results and free-form verdict/tier/scope) into
-    the bundled ``report-template.html`` as ``{{REPORT_DATA}}`` and writes
-    the standalone file (default ``repo_root/code-review-report.html``).
+    the bundled ``report-template.html`` as ``{{REPORT_DATA}}`` (HTML) and/or
+    renders a standalone Chinese Markdown report.  Both are written by
+    default.  ``output_path`` is the base name without an extension.
 
     Offloaded to a thread via ``asyncio.to_thread`` — rendering loads the
-    template asset and writes the output file.
+    template asset and writes the output file(s).
 
     Args:
         review_data: Review data dict (metrics, findings, verdict, tier,
             scope, files, baseline, timestamp, manual_review).
-        output_path: Output file path.  Defaults to
-            ``<repo_root>/code-review-report.html``.
+        output_path: Output base path (no extension).  Defaults to
+            ``<repo_root>/code-review-report``.
         repo_root: Repository root path. Auto-detected if omitted.
+        format: Output format.  ``html``, ``markdown``, or ``both``
+            (default: both).
     """
     root = _resolve_repo_root(repo_root)
 
     def _run() -> dict:
         return with_provenance(generate_report_func(
             review_data=review_data, output_path=output_path,
-            repo_root=root,
+            repo_root=root, format=format,
         ), root)
 
     return await asyncio.to_thread(_run)
@@ -1140,6 +1149,23 @@ def unified_review(base: str = "HEAD~1", tier: str = "standard") -> list[dict]:
     return unified_review_prompt(base=base, tier=tier)
 
 
+@mcp.prompt()
+def project_review(scope: str = "whole-project", target: str = "") -> list[dict]:
+    """Whole-project or single-feature code review (not diff-based).
+
+    Reviews the entire codebase (whole-project) or a single feature/module
+    (feature) using graph-wide analysis and objective scoring, independent
+    of the git diff.  READ-ONLY: every finding waits for a manual fix
+    decision.
+
+    Args:
+        scope: Review scope.  ``whole-project`` reviews every source file;
+            ``feature`` reviews only the target's code.
+        target: Feature/module/function keyword when scope="feature".
+    """
+    return project_review_prompt(scope=scope, target=target)
+
+
 def _apply_tool_filter(tools: str | None = None) -> None:
     """Remove tools not listed in the allow-list.
 
diff --git a/code_review_graph/prompts.py b/code_review_graph/prompts.py
index d7b2742..2239c86 100644
--- a/code_review_graph/prompts.py
+++ b/code_review_graph/prompts.py
@@ -1,6 +1,6 @@
 """MCP prompt templates for Code Review Graph.
 
-Provides 6 pre-built prompt workflows, all enforcing token-efficient
+Provides 7 pre-built prompt workflows, all enforcing token-efficient
 detail_level="minimal" first patterns with get_minimal_context entry point.
 
 1. review_changes   - pre-commit review using detect_changes + affected_flows
@@ -9,6 +9,7 @@ detail_level="minimal" first patterns with get_minimal_context entry point.
 4. onboard_developer - new dev orientation using stats, architecture, flows
 5. pre_merge_check  - PR readiness with risk scoring, test gaps, dead code
 6. unified_review   - three-layer review: graph context + scoring + dedupe + report
+7. project_review   - whole-project or single-feature review (not diff-based)
 """
 
 from __future__ import annotations
@@ -209,9 +210,91 @@ def unified_review_prompt(
         '6. Call `dedupe_findings(findings=<your findings>)` to merge '
         "by fingerprint, boost multi-source confidence and compute the "
         "PR quality score.\n"
-        '7. Call `generate_report(review_data=<verdict, tier, scope, '
-        'metrics, merged findings>)` to write code-review-report.html.\n'
-        "8. Output: verdict (✅ PASS / ❌ FAIL), severity counts, each "
-        "issue with confidence + fix, and the manual-review items.  "
-        "Any blocker → verdict ❌ FAIL."
+         '7. Call `generate_report(review_data=<verdict, tier, scope, '
+         'metrics, merged findings>)` to write code-review-report.html '
+         "and code-review-report.md (format=\"both\").\n"
+         "8. Output: verdict (✅ PASS / ❌ FAIL), severity counts, each "
+         "issue with confidence + fix, and the manual-review items.  "
+         "Any blocker → verdict ❌ FAIL."
     )
+
+
+def project_review_prompt(
+    scope: str = "whole-project",
+    target: str = "",
+) -> list[Message]:
+    """Whole-project or single-feature code review workflow (not diff-based).
+
+    Reviews the entire codebase (``scope="whole-project"``) or a single
+    feature/module/function (``scope="feature"`` with ``target``), using
+    graph-wide analysis and objective scoring independent of the git diff.
+    READ-ONLY: every finding waits for a manual fix decision.
+
+    Args:
+        scope: ``whole-project`` reviews every source file in the graph;
+            ``feature`` reviews only the code related to ``target``.
+        target: Feature/module/function keyword when ``scope="feature"``
+            (e.g. "payment", "auth", "checkout flow").
+    """
+    scope_note = (
+        "whole-project scope: score every source file with "
+        "`score_review(all_files=True)`."
+        if scope == "whole-project"
+        else (
+            "feature scope: locate the target's files with semantic search "
+            "and graph queries, then score only those files."
+        )
+    )
+
+    common = (
+        f"## Project Review Workflow (scope={scope}, target={target})\n"
+        f"{scope_note}\n"
+        "**READ-ONLY.** Present every finding for a manual fix decision. "
+        "Never modify code, commit, or push.\n"
+        '1. Call `get_minimal_context(task="project review")` for graph '
+        "stats and community overview.\n"
+        '2. Call `build_or_update_graph()` to ensure the graph is current.\n'
+        '3. Map the architecture: `get_architecture_overview('
+        'detail_level="minimal")` and `list_communities('
+        'detail_level="minimal")`.\n'
+        '4. Locate high-risk areas: `get_knowledge_gaps()`, '
+        '`get_hub_nodes()`, `get_bridge_nodes()`, `find_large_functions()` '
+        "and `get_surprising_connections()`.\n"
+    )
+
+    if scope == "whole-project":
+        workflow = (
+            '5. Score every source file: `score_review(all_files=True)`.\n'
+            "6. For the top-risk communities, drill in with "
+            '`get_community(include_members=True)` and '
+            '`query_graph(pattern="children_of", target=<community>)`.\n'
+            "7. Produce findings with severity (blocker/major/minor), "
+            "confidence (1-10), file:line and a proposed fix.\n"
+            "8. Call `dedupe_findings(findings=<your findings>)` to merge "
+            "and compute the PR quality score.\n"
+            '9. Call `generate_report(review_data=<verdict, scope, '
+            'metrics, merged findings>)` (format="both").\n'
+            "10. Output the verdict (✅ PASS / ❌ FAIL), severity counts, "
+            "each issue, and the manual-review items.\n"
+        )
+    else:
+        workflow = (
+            '5. Locate the feature code: `semantic_search_nodes(query='
+            '<target>)` and `query_graph(pattern="children_of", '
+            'target=<target>)`; collect the related files.\n'
+            "6. Map the blast radius: `get_impact_radius(changed_files="
+            "<collected files>)`.\n"
+            '7. Score the feature: `score_review(changed_files=<files + '
+            'impacted files>)`.\n'
+            "8. Review the feature code (Layer 1 chain decomposition) and "
+            "produce findings with severity, confidence, file:line and a "
+            "proposed fix.\n"
+            "9. Call `dedupe_findings(findings=<your findings>)` to merge "
+            "and compute the PR quality score.\n"
+            '10. Call `generate_report(review_data=<verdict, scope, '
+            'metrics, merged findings>)` (format="both").\n'
+            "11. Output the verdict (✅ PASS / ❌ FAIL), severity counts, "
+            "each issue, and the manual-review items.\n"
+        )
+
+    return _user(f"{_TOKEN_EFFICIENCY_PREAMBLE}\n{common}{workflow}")
diff --git a/code_review_graph/scoring.py b/code_review_graph/scoring.py
index b39c801..ef1d1c0 100644
--- a/code_review_graph/scoring.py
+++ b/code_review_graph/scoring.py
@@ -624,6 +624,8 @@ def build_report_data(
         "files": review_data.get("files", ""),
         "baseline": review_data.get("baseline", "generic"),
         "verdict": review_data.get("verdict", "❌ FAIL"),
+        "quality_score": review_data.get("quality_score"),
+        "counts": review_data.get("counts", {}),
         "metrics": {},
         "issues": [],
         "manual_review": review_data.get("manual_review", []),
@@ -656,3 +658,135 @@ def build_report_data(
         })
 
     return data
+
+
+# ---------------------------------------------------------------------------
+# Markdown report rendering (Chinese)
+# ---------------------------------------------------------------------------
+
+#: Human-readable labels for the Chinese Markdown report.
+_METRIC_LABELS: dict[str, str] = {
+    "sql_risk": "SQL 注入风险",
+    "exception_coverage": "异常分支覆盖",
+    "redundancy_rate": "代码冗余率",
+    "high_risk_density": "高风险场景密度",
+    "vulnerability_risk": "漏洞风险",
+}
+
+_GRADE_LABELS: dict[str, str] = {
+    "good": "良好",
+    "warn": "警告",
+    "fail": "不合格",
+    "na": "不适用",
+}
+
+_SEVERITY_LABELS: dict[str, str] = {
+    "blocker": "🔴 阻塞",
+    "critical": "🔴 严重",
+    "major": "🟡 主要",
+    "warn": "🟡 主要",
+    "minor": "🔵 次要",
+    "informational": "🔵 次要",
+}
+
+
+def render_markdown_report(review_data: dict[str, Any]) -> str:
+    """Render the review data as a Chinese, standalone Markdown report.
+
+    Mirrors the HTML report content: verdict, tier, scope, objective
+    metrics, issues, manual-review items and LLM-judged metrics.  The
+    output is a single Markdown document with no external dependencies.
+
+    Args:
+        review_data: Review data dict (see :func:`build_report_data`).
+
+    Returns:
+        The Markdown report text.
+    """
+    data = build_report_data(review_data)
+    lines: list[str] = []
+
+    lines.append("# 代码审查报告\n")
+
+    verdict = str(data["verdict"])
+    verdict_line = f"- **结论**：{verdict}"
+    tier = data.get("tier") or "standard"
+    scope = data.get("scope") or "change-level"
+    baseline = data.get("baseline") or "generic"
+    lines.append(verdict_line)
+    lines.append(
+        f"- **档位**：{tier} · **范围**：{scope} · **基线**：{baseline}"
+    )
+    if data.get("timestamp"):
+        lines.append(f"- **生成时间**：{data['timestamp']}")
+    if data.get("files"):
+        lines.append(f"- **文件**：{data['files']}")
+    qs = data.get("quality_score")
+    if qs is not None:
+        lines.append(f"- **PR 质量分**：{qs}/10")
+    counts = data.get("counts") or {}
+    if counts:
+        lines.append(
+            f"- **问题统计**：{counts.get('critical', 0)} 严重 · "
+            f"{counts.get('informational', 0)} 次要"
+        )
+    lines.append("")
+
+    # Objective metrics
+    metrics = data.get("metrics") or {}
+    if metrics:
+        lines.append("## 客观指标\n")
+        lines.append("| 指标 | 数值 | 评级 | 说明 |")
+        lines.append("|---|---|---|---|")
+        for name, m in metrics.items():
+            label = _METRIC_LABELS.get(name, name)
+            value = m.get("value")
+            value_text = str(value) if value is not None else "N/A"
+            grade = m.get("grade") or "na"
+            grade_text = _GRADE_LABELS.get(grade, grade)
+            note = str(m.get("note", "") or "")
+            note = note.replace("\n", " ")
+            lines.append(f"| {label} | {value_text} | {grade_text} | {note} |")
+        lines.append("")
+
+    # Issues
+    issues = data.get("issues") or []
+    lines.append(f"## 问题清单（{len(issues)}）\n")
+    if not issues:
+        lines.append("未发现问题。\n")
+    for i, issue in enumerate(issues, start=1):
+        sev = str(issue.get("severity") or "minor").lower()
+        sev_label = _SEVERITY_LABELS.get(sev, sev)
+        category = str(issue.get("category") or "")
+        message = str(issue.get("message") or "")
+        location = str(issue.get("location") or "")
+        conf = issue.get("confidence")
+        fix = str(issue.get("fix") or "")
+        lines.append(
+            f"{i}. **{sev_label}** {message}"
+            f"{f'（置信度 {conf}/10）' if conf is not None else ''}"
+        )
+        if category:
+            lines.append(f"   - **类别**：{category}")
+        if location:
+            lines.append(f"   - **位置**：`{location}`")
+        if fix:
+            lines.append(f"   - **修复建议**：{fix}")
+        lines.append("")
+
+    # Manual review
+    manual = data.get("manual_review") or []
+    if manual:
+        lines.append("## 需要人工审查\n")
+        for m in manual:
+            lines.append(f"- {m}")
+        lines.append("")
+
+    # LLM-judged metrics
+    judged = data.get("llm_judged") or []
+    if judged:
+        lines.append("## 需 LLM 判断的指标\n")
+        lines.append(", ".join(str(j) for j in judged))
+        lines.append("")
+
+    return "\n".join(lines).strip() + "\n"
diff --git a/code_review_graph/skills.py b/code_review_graph/skills.py
index 421a39a..d822648 100644
--- a/code_review_graph/skills.py
+++ b/code_review_graph/skills.py
@@ -809,8 +809,8 @@ _SKILLS: dict[str, dict[str, str]] = {
             "### Step 8 - Report\n"
             "Call `generate_report_tool(review_data=<collected verdict, "
             "metrics, findings, tier, scope>)` to write "
-            "`code-review-report.html`.  Also present the text report "
-            "inline.\n\n"
+            "`code-review-report.html` and `code-review-report.md` (default "
+            "`format=\"both\"`).  Also present the text report inline.\n\n"
             "### Step 9 - Persistence (optional)\n"
             "If the `gstack-review-log` binary is available, record the "
             "review outcome (status, counts, quality score, per-finding "
@@ -830,6 +830,89 @@ _SKILLS: dict[str, dict[str, str]] = {
             "≤1200 total output tokens."
         ),
     },
+    "project-review.md": {
+        "name": "project-review",
+        "description": (
+            "Whole-project or single-feature code review (not diff-based) "
+            "using graph-wide analysis and objective scoring"
+        ),
+        "body": (
+            "## Project Review\n\n"
+            "Review the entire codebase or a single feature/module, "
+            "independent of the git diff.  Two scopes, driven by the "
+            "user's instruction:\n"
+            "- **whole-project**: \"对项目代码进行全面审查\", \"全面审查\", "
+            "\"整个项目\" → review every source file in the graph.\n"
+            "- **feature**: \"审查 <功能/模块> 的代码\" (e.g. payment, "
+            "auth) → review only the code related to the target.\n\n"
+            "**This skill is READ-ONLY.** Every finding is presented to the "
+            "user for a manual fix decision. Never apply code changes, "
+            "commit, or push.\n\n"
+            "### Token Efficiency Rules\n"
+            '- ALWAYS start with `get_minimal_context(task="project review")`. '
+            'Use `detail_level="minimal"` on all calls; escalate to '
+            '"standard" only when a metric or finding needs evidence.\n\n'
+            "### Step 0 - Parse the scope\n"
+            "Read the user's instruction and set scope: whole-project "
+            "(contains 全面/整个项目/所有/all) or feature + target "
+            "(extract the feature/module keyword).  Declare both in the "
+            "report header.\n\n"
+            "### Step 1 - Graph ready\n"
+            "1. Call `build_or_update_graph_tool()` to ensure the graph is "
+            "current.\n"
+            "2. Call `get_minimal_context_tool(task=\"project review\")` "
+            "for stats and community overview.\n\n"
+            "### Step 2 - Architecture map\n"
+            "Call `get_architecture_overview_tool(detail_level=\"minimal\")` "
+            "and `list_communities_tool(detail_level=\"minimal\")` to map "
+            "the module structure.\n\n"
+            "### Step 3 - High-risk scan (whole-project)\n"
+            "Call `get_knowledge_gaps_tool()`, `get_hub_nodes_tool()`, "
+            "`get_bridge_nodes_tool()`, `find_large_functions_tool()` and "
+            "`get_surprising_connections_tool()` to locate hotspots, "
+            "chokepoints, untested areas and odd coupling.\n\n"
+            "### Step 4 - Objective scoring\n"
+            "- whole-project: `score_review_tool(all_files=True)` scores "
+            "every source file in the graph.\n"
+            "- feature: locate the target files with "
+            "`semantic_search_nodes_tool(query=<target>)` and "
+            "`query_graph_tool(pattern=\"children_of\", target=<target>)`, "
+            "then `score_review_tool(changed_files=<files>)` and "
+            "`get_impact_radius_tool(changed_files=<files>)` for the "
+            "blast radius.\n\n"
+            "### Step 5 - Chain decomposition\n"
+            "Inspect the scored code across eight categories (interface, "
+            "business, data, utility, error handling, security, "
+            "performance, observability) and apply the gstack CRITICAL "
+            "sub-pass (SQL & Data Safety, Race Conditions, LLM Output "
+            "Trust Boundary, Shell Injection, Enum Completeness).  Mark "
+            "each ✅ / ⚠️ / —.\n\n"
+            "### Step 6 - Manual adjudication (READ-ONLY)\n"
+            "Present every finding with severity (🔴 blocker / 🟡 major / "
+            "🔵 minor), confidence (1-10), file:line and a proposed fix.  "
+            "Group by severity and ask the user per batch: fix / skip / "
+            "self-fix.  🔴 blockers cannot be batch-skipped.  **Do not "
+            "modify code.**\n\n"
+            "### Step 7 - Acceptance gate\n"
+            "Any 🔴 blocker → verdict `❌ FAIL`.  Classify each finding as "
+            "Ready / Needs Fix / Unusable.\n\n"
+            "### Step 8 - Report\n"
+            "Call `generate_report_tool(review_data=<verdict, scope, "
+            "metrics, findings>)` to write `code-review-report.html` and "
+            "`code-review-report.md` (default `format=\"both\"`).\n\n"
+            "### Output Format\n"
+            "`Project Review: N issues (X blocker, Y major, Z minor) — "
+            "verdict: ✅ PASS / ❌ FAIL`.  List each issue with severity, "
+            "confidence, file:line, problem, and proposed fix.\n\n"
+            "## Token Efficiency Rules\n"
+            '- ALWAYS start with `get_minimal_context(task="project review")` '
+            "before any other graph tool.\n"
+            '- Use `detail_level="minimal"` on all calls. Only escalate to '
+            '"standard" when minimal is insufficient.\n'
+            "- Target: complete a project review in ≤12 tool calls and "
+            "≤1800 total output tokens."
+        ),
+    },
     "debug-issue.md": {
         "name": "debug-issue",
         "description": "Systematically debug issues using graph-powered code navigation",
diff --git a/code_review_graph/tools/__init__.py b/code_review_graph/tools/__init__.py
index c73191a..512bc5b 100644
--- a/code_review_graph/tools/__init__.py
+++ b/code_review_graph/tools/__init__.py
@@ -31,7 +31,7 @@ Exposes 31 tools:
 28. traverse_graph        - BFS/DFS traversal from best-matching node
 29. score_review          - objective Layer-2 review metrics for changed files
 30. dedupe_findings       - fingerprint dedup + confidence merge for findings
-31. generate_report       - render the standalone HTML code review report
+31. generate_report       - render the HTML and/or Markdown review report
 """
 
 from __future__ import annotations
diff --git a/code_review_graph/tools/docs.py b/code_review_graph/tools/docs.py
index 48a8711..8477890 100644
--- a/code_review_graph/tools/docs.py
+++ b/code_review_graph/tools/docs.py
@@ -115,8 +115,9 @@ def get_docs_section(
 
     Args:
         section_name: Exact section name. One of: usage, review-delta,
-                      review-pr, unified-review, score-review, commands,
-                      legal, watch, embeddings, languages, troubleshooting.
+                      review-pr, unified-review, project-review, score-review,
+                      commands, legal, watch, embeddings, languages,
+                      troubleshooting.
         repo_root: Repository root path. Auto-detected from current
                    directory if omitted.
 
@@ -178,8 +179,8 @@ def get_docs_section(
 
     available = [
         "usage", "review-delta", "review-pr", "unified-review",
-        "score-review", "commands", "legal", "watch", "embeddings",
-        "languages", "troubleshooting",
+        "project-review", "score-review", "commands", "legal", "watch",
+        "embeddings", "languages", "troubleshooting",
     ]
     return {
         "status": "not_found",
diff --git a/code_review_graph/tools/scoring_tools.py b/code_review_graph/tools/scoring_tools.py
index debfbe6..698a575 100644
--- a/code_review_graph/tools/scoring_tools.py
+++ b/code_review_graph/tools/scoring_tools.py
@@ -6,7 +6,7 @@ build_report_data) into the three MCP tools consumed by the
 
 * ``score_review_tool`` - objective Layer-2 metrics for changed files
 * ``dedupe_findings_tool`` - fingerprint dedup + confidence merge
-* ``generate_report_tool`` - render ``code-review-report.html``
+* ``generate_report_tool`` - render the HTML and/or Markdown review report
 """
 
 from __future__ import annotations
@@ -16,7 +16,12 @@ from pathlib import Path
 from typing import Any
 
 from ..incremental import get_changed_files, get_staged_and_unstaged
-from ..scoring import build_report_data, dedupe_findings, score_review
+from ..scoring import (
+    build_report_data,
+    dedupe_findings,
+    render_markdown_report,
+    score_review,
+)
 from ._common import _get_store, _error_response
 
 try:
@@ -38,6 +43,7 @@ def score_review_func(
     include_churn: bool = True,
     repo_root: str | None = None,
     detail_level: str = "standard",
+    all_files: bool = False,
 ) -> dict[str, Any]:
     """Compute objective Layer-2 review metrics for changed files.
 
@@ -54,10 +60,15 @@ def score_review_func(
         repo_root: Repository root. Auto-detected if omitted.
         detail_level: Output detail level.  ``minimal`` returns only grades
             and values; ``standard`` includes evidence.
+        all_files: When True, score every source file in the graph,
+            ignoring ``changed_files`` and the git diff.  Used for
+            whole-project reviews (default: False).
     """
     store, root = _get_store(repo_root)
     try:
-        if changed_files is None:
+        if all_files:
+            changed_files = store.get_all_files()
+        elif changed_files is None:
             changed_files = get_changed_files(root, base)
             if not changed_files:
                 changed_files = get_staged_and_unstaged(root)
@@ -223,45 +234,77 @@ def generate_report_func(
     review_data: dict[str, Any],
     output_path: str | None = None,
     repo_root: str | None = None,
+    format: str = "both",
 ) -> dict[str, Any]:
-    """Generate a self-contained HTML code review report.
+    """Generate code review reports (HTML and/or Markdown).
 
-    Injects ``review_data`` (the output of ``score_review_tool`` plus
+    Renders ``review_data`` (the output of ``score_review_tool`` plus
     ``dedupe_findings_tool`` results and free-form verdict/tier/scope) into
-    the bundled ``report-template.html`` as ``{{REPORT_DATA}}`` and writes
-    the standalone file (default ``repo_root/code-review-report.html``).
+    a self-contained HTML report (``report-template.html``) and/or a
+    standalone Chinese Markdown report.  Both are written by default.
+
+    ``output_path`` is treated as the basename/directory of the output:
+    the extension is decided by ``format``, so ``both`` writes
+    ``<base>.html`` and ``<base>.md``.
 
     Args:
         review_data: Review data dict (metrics, findings, verdict, tier,
             scope, files, baseline, timestamp, manual_review).
-        output_path: Output file path.  Defaults to
-            ``<repo_root>/code-review-report.html``.
+        output_path: Output base path (without an extension).  Defaults to
+            ``<repo_root>/code-review-report``.
         repo_root: Repository root. Auto-detected if omitted.
+        format: Output format.  ``html``, ``markdown``, or ``both``
+            (default: both).
     """
+    if format not in ("html", "markdown", "both"):
+        return _error_response(
+            f"Invalid format {format!r}; expected 'html', 'markdown' or 'both'."
+        )
     store, root = _get_store(repo_root)
     try:
         data = build_report_data(review_data)
         data["summary"] = review_data.get("summary", "")
 
-        template = _load_report_template()
-        rendered = template.replace(
-            "{{REPORT_DATA}}", json.dumps(data, ensure_ascii=False)
-        )
-
         if output_path:
-            out = Path(output_path)
-            if not out.is_absolute():
-                out = root / out
+            base = Path(output_path)
+            if not base.is_absolute():
+                base = root / base
         else:
-            out = root / "code-review-report.html"
+            base = root / "code-review-report"
 
-        out.parent.mkdir(parents=True, exist_ok=True)
-        out.write_text(rendered, encoding="utf-8")
+        written: list[dict[str, Any]] = []
+        if format in ("html", "both"):
+            template = _load_report_template()
+            rendered = template.replace(
+                "{{REPORT_DATA}}", json.dumps(data, ensure_ascii=False)
+            )
+            html_path = base.with_suffix(".html")
+            html_path.parent.mkdir(parents=True, exist_ok=True)
+            html_path.write_text(rendered, encoding="utf-8")
+            written.append({
+                "format": "html",
+                "output_path": str(html_path),
+                "size_bytes": len(rendered),
+            })
+
+        if format in ("markdown", "both"):
+            rendered_md = render_markdown_report(review_data)
+            md_path = base.with_suffix(".md")
+            md_path.parent.mkdir(parents=True, exist_ok=True)
+            md_path.write_text(rendered_md, encoding="utf-8")
+            written.append({
+                "format": "markdown",
+                "output_path": str(md_path),
+                "size_bytes": len(rendered_md),
+            })
+
+        paths = [w["output_path"] for w in written]
         return {
             "status": "ok",
-            "summary": f"Report written to {out}",
-            "output_path": str(out),
-            "report_size_bytes": len(rendered),
+            "summary": f"Report written to {', '.join(paths)}",
+            "output_path": paths[0] if len(paths) == 1 else paths,
+            "files": written,
+            "report_size_bytes": sum(w["size_bytes"] for w in written),
         }
     except Exception as exc:
         return _error_response(str(exc))
diff --git a/docs/COMMANDS.md b/docs/COMMANDS.md
index f15e927..3d3be6f 100644
--- a/docs/COMMANDS.md
+++ b/docs/COMMANDS.md
@@ -28,6 +28,13 @@ Three-layer unified code review (CRG graph context + ai-code-review scoring + gs
 - Fingerprint merge + quality score via `dedupe_findings_tool`
 - Standalone HTML report via `generate_report_tool`
 
+### `/code-review-graph:project-review`
+Whole-project or single-feature code review (not diff-based).
+- Scope parsed from user instruction: 全面/整个项目 → whole-project; otherwise feature + target
+- Whole-project: `score_review_tool(all_files=True)` scores every source file
+- Feature: `semantic_search_nodes` + `query_graph(children_of)` locate the code
+- Read-only: every finding waits for a manual fix decision
+
 ## MCP Tools
 
 ### Core Tools
@@ -259,11 +266,14 @@ findings to the appendix, and computes `PR quality score = max(0, 10 -
 #### `generate_report_tool`
 ```
 review_data: dict                 # metrics + findings + verdict + tier + scope
-output_path: str | None           # Default: <repo_root>/code-review-report.html
-repo_root: str | None
+output_path: str | None           # Base name without extension
+repo_root: str | None             # Default: <repo_root>/code-review-report
+format: str = "both"              # "html" | "markdown" | "both"
 ```
-Renders the standalone HTML code review report (self-contained, no external
-dependencies) from the bundled `report-template.html`.
+Renders the standalone HTML review report (self-contained, no external
+dependencies) and/or the Chinese Markdown report from the bundled
+`report-template.html`.  Default `format="both"` writes
+`code-review-report.html` + `code-review-report.md`.
 
 #### `refactor_tool`
 ```
@@ -310,7 +320,7 @@ kind: str | None
 limit: int = 20
 ```
 
-## MCP Prompts (6 workflow templates)
+## MCP Prompts (7 workflow templates)
 
 ### `review_changes`
 Pre-commit review workflow using detect_changes, affected_flows, and test gaps.
@@ -346,6 +356,17 @@ base: str = "HEAD~1"
 tier: str = "standard"   # fast | standard | strict
 ```
 
+### `project_review`
+Whole-project or single-feature code review (not diff-based). Reviews
+the entire codebase or a single feature/module using graph-wide analysis
+and objective scoring. READ-ONLY: every finding waits for a manual fix
+decision. Scope is parsed from the user instruction (全面/整个项目 →
+whole-project; otherwise feature + target keyword).
+```
+scope: str = "whole-project"   # whole-project | feature
+target: str = ""               # feature/module keyword when scope="feature"
+```
+
 ## CLI Commands
 
 ```bash
diff --git a/docs/INDEX.md b/docs/INDEX.md
index 4a6d0da..6d6f37f 100644
--- a/docs/INDEX.md
+++ b/docs/INDEX.md
@@ -3,7 +3,7 @@
 - [USAGE.md](USAGE.md) -- How to install and use
 - [FAQ.md](FAQ.md) -- How it compares to LSP, RAG, grep, and similar tools; when not to use it
 - [FEATURES.md](FEATURES.md) -- What's included, changelog
-- [COMMANDS.md](COMMANDS.md) -- All 31 MCP tools, 6 MCP prompts, skills, and CLI commands
+- [COMMANDS.md](COMMANDS.md) -- All 31 MCP tools, 7 MCP prompts, skills, and CLI commands
 - [GITHUB_ACTION.md](GITHUB_ACTION.md) -- Risk-scored PR review comments via GitHub Actions
 - [CUSTOM_LANGUAGES.md](CUSTOM_LANGUAGES.md) -- Bring your own language via `.code-review-graph/languages.toml`
 - [LLM-OPTIMIZED-REFERENCE.md](../code_review_graph/docs/LLM-OPTIMIZED-REFERENCE.md) -- Token-optimized reference for MCP-capable AI coding agents
diff --git a/docs/architecture.md b/docs/architecture.md
index 5a3bd4d..d2fa798 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -20,7 +20,7 @@
 │  ┌────────────────────────────────────────────┐              │
 │  │      MCP Server (stdio or localhost HTTP)  │              │
 │  │                                            │              │
-│  │  31 MCP Tools + 6 MCP Prompts              │              │
+│  │  31 MCP Tools + 7 MCP Prompts              │              │
 │  │  ├── Core: build, impact, query, review,   │              │
 │  │  │   search, traverse, embed, stats, docs  │              │
 │  │  ├── Flows: list, get, affected            │              │
diff --git a/skills/project-review/SKILL.md b/skills/project-review/SKILL.md
new file mode 100644
index 0000000..e9fd05f
--- /dev/null
+++ b/skills/project-review/SKILL.md
@@ -0,0 +1,63 @@
+---
+name: project-review
+description: Whole-project or single-feature code review (not diff-based) using graph-wide analysis and objective scoring
+---
+
+# Project Review
+
+Review the entire codebase or a single feature/module, independent of the git diff.  Two scopes, driven by the user's instruction:
+
+- **whole-project**: "对项目代码进行全面审查", "全面审查", "整个项目" → review every source file in the graph.
+- **feature**: "审查 <功能/模块> 的代码" (e.g. payment, auth) → review only the code related to the target.
+
+**This skill is READ-ONLY.** Every finding is presented to the user for a manual fix decision. Never apply code changes, commit, or push.
+
+## Token Efficiency Rules
+- ALWAYS start with `get_minimal_context(task="project review")`. Use `detail_level="minimal"` on all calls; escalate to `"standard"` only when a metric or finding needs evidence.
+
+## Step 0 - Parse the scope
+
+Read the user's instruction and set scope: whole-project (contains 全面/整个项目/所有/all) or feature + target (extract the feature/module keyword).  Declare both in the report header.
+
+## Step 1 - Graph ready
+
+1. Call `build_or_update_graph_tool()` to ensure the graph is current.
+2. Call `get_minimal_context_tool(task="project review")` for stats and community overview.
+
+## Step 2 - Architecture map
+
+Call `get_architecture_overview_tool(detail_level="minimal")` and `list_communities_tool(detail_level="minimal")` to map the module structure.
+
+## Step 3 - High-risk scan (whole-project)
+
+Call `get_knowledge_gaps_tool()`, `get_hub_nodes_tool()`, `get_bridge_nodes_tool()`, `find_large_functions_tool()` and `get_surprising_connections_tool()` to locate hotspots, chokepoints, untested areas and odd coupling.
+
+## Step 4 - Objective scoring
+
+- whole-project: `score_review_tool(all_files=True)` scores every source file in the graph.
+- feature: locate the target files with `semantic_search_nodes_tool(query=<target>)` and `query_graph_tool(pattern="children_of", target=<target>)`, then `score_review_tool(changed_files=<files>)` and `get_impact_radius_tool(changed_files=<files>)` for the blast radius.
+
+## Step 5 - Chain decomposition
+
+Inspect the scored code across eight categories (interface, business, data, utility, error handling, security, performance, observability) and apply the gstack CRITICAL sub-pass (SQL & Data Safety, Race Conditions, LLM Output Trust Boundary, Shell Injection, Enum Completeness).  Mark each ✅ / ⚠️ / —.
+
+## Step 6 - Manual adjudication (READ-ONLY)
+
+Present every finding with severity (🔴 blocker / 🟡 major / 🔵 minor), confidence (1-10), file:line and a proposed fix.  Group by severity and ask the user per batch: fix / skip / self-fix.  🔴 blockers cannot be batch-skipped.  **Do not modify code.**
+
+## Step 7 - Acceptance gate
+
+Any 🔴 blocker → verdict `❌ FAIL`.  Classify each finding as Ready / Needs Fix / Unusable.
+
+## Step 8 - Report
+
+Call `generate_report_tool(review_data=<verdict, scope, metrics, findings>)` to write `code-review-report.html` and `code-review-report.md` (default `format="both"`).
+
+## Output Format
+
+`Project Review: N issues (X blocker, Y major, Z minor) — verdict: ✅ PASS / ❌ FAIL`.  List each issue with severity, confidence, file:line, problem, and proposed fix.
+
+## Token Efficiency Rules
+- ALWAYS start with `get_minimal_context(task="project review")` before any other graph tool.
+- Use `detail_level="minimal"` on all calls. Only escalate to `"standard"` when minimal is insufficient.
+- Target: complete a project review in ≤12 tool calls and ≤1800 total output tokens.
diff --git a/skills/project-review/references/common-mistakes.md b/skills/project-review/references/common-mistakes.md
new file mode 100644
index 0000000..52ee84b
--- /dev/null
+++ b/skills/project-review/references/common-mistakes.md
@@ -0,0 +1,19 @@
+# Unified Review — Common Mistakes
+
+- **Skipping graph context** — always run `get_minimal_context` first; CRG
+  context is what makes the review token-efficient and blast-radius aware.
+- **Rushing to fix** — this skill is READ-ONLY. Present findings, wait for
+  user decision. Never apply fixes, commit, or push.
+- **Ignoring tier** — read `.code-review.yaml`. `fast` skips Layer 2/3;
+  `strict` requires per-item confirmation for every blocker/major.
+- **Judging metrics without evidence** — `score_review_tool` outputs are
+  heuristics. Cite the evidence, and let the LLM confirm SQL/exception/vuln
+  findings before presenting them as facts.
+- **Missing manual-review modules** — payment, order, inventory, permission,
+  distributed-lock, data-migration always require a manual review checklist.
+- **Forgetting enum completeness reads OUTSIDE the diff** — grep sibling
+  values, then read each consumer; in-diff review alone is insufficient.
+- **Batch-skipping blockers** — 🔴 blockers cannot be batch-skipped; each
+  needs an explicit user decision.
+- **Not producing the report** — always call `generate_report_tool` at the
+  end and present the text report inline.
diff --git a/skills/project-review/references/manual-review/data-migration.md b/skills/project-review/references/manual-review/data-migration.md
new file mode 100644
index 0000000..39ebe8e
--- /dev/null
+++ b/skills/project-review/references/manual-review/data-migration.md
@@ -0,0 +1,12 @@
+# Data Migration — Manual Review Checklist
+
+High-risk module: schema/data migration requires human confirmation.
+
+- [ ] Migration is idempotent and re-runnable
+- [ ] Forward and rollback paths both defined and tested
+- [ ] Backfill is batched / resumable for large tables
+- [ ] Data type / precision changes do not silently truncate
+- [ ] Nullability and default changes safe for existing rows
+- [ ] Migration ordering across shards / replicas is consistent
+- [ ] Application deploys compatibly with both old and new schema (expand/contract)
+- [ ] Irreversible operations are flagged with a documented reason
diff --git a/skills/project-review/references/manual-review/distributed-lock.md b/skills/project-review/references/manual-review/distributed-lock.md
new file mode 100644
index 0000000..b81b7dd
--- /dev/null
+++ b/skills/project-review/references/manual-review/distributed-lock.md
@@ -0,0 +1,11 @@
+# Distributed Lock — Manual Review Checklist
+
+High-risk module: distributed-lock changes require architecture confirmation.
+
+- [ ] Lock has a TTL / expiry — no permanent deadlock after crash
+- [ ] Lock release is atomic and ownership-checked (compare-and-delete)
+- [ ] Lock scope is correct (key includes the right entity identifiers)
+- [ ] Renewal / watchdog exists for long critical sections
+- [ ] Locking order is consistent across paths (no lock-ordering deadlock)
+- [ ] Fencing tokens / version check prevents stale-holder writes
+- [ ] Fail-open vs fail-closed behavior is intentional and documented
diff --git a/skills/project-review/references/manual-review/inventory.md b/skills/project-review/references/manual-review/inventory.md
new file mode 100644
index 0000000..9b416e6
--- /dev/null
+++ b/skills/project-review/references/manual-review/inventory.md
@@ -0,0 +1,11 @@
+# Inventory Module — Manual Review Checklist
+
+High-risk module: stock/inventory changes require human confirmation.
+
+- [ ] Stock decrement is atomic (conditional UPDATE, not read-then-write)
+- [ ] Oversell prevented: `UPDATE ... SET qty = qty - ? WHERE qty >= ?`
+- [ ] Reservation vs. deduction semantics are consistent
+- [ ] Concurrent orders cannot both reserve the last unit
+- [ ] Restock/return increments handled correctly
+- [ ] Inventory events are idempotent (retry-safe)
+- [ ] Async stock updates propagate to downstream (warehouse, carts) safely
diff --git a/skills/project-review/references/manual-review/order.md b/skills/project-review/references/manual-review/order.md
new file mode 100644
index 0000000..ca79baa
--- /dev/null
+++ b/skills/project-review/references/manual-review/order.md
@@ -0,0 +1,12 @@
+# Order Module — Manual Review Checklist
+
+High-risk module: order lifecycle changes require human confirmation.
+
+- [ ] State machine transitions are atomic (`WHERE status = ?` updates)
+- [ ] Cancellation / timeout / expiry paths complete all side effects
+- [ ] Order idempotency key prevents duplicate order creation
+- [ ] Price/lock snapshot captured at order time, not at payment time
+- [ ] Partial fulfillment / split-shipment handled
+- [ ] Negative or inconsistent totals impossible
+- [ ] Concurrent edits (cart + order) do not corrupt state
+- [ ] Audit trail: every status change logged with reason
diff --git a/skills/project-review/references/manual-review/payment.md b/skills/project-review/references/manual-review/payment.md
new file mode 100644
index 0000000..2391446
--- /dev/null
+++ b/skills/project-review/references/manual-review/payment.md
@@ -0,0 +1,14 @@
+# Payment Module — Manual Review Checklist
+
+High-risk module: payment changes require human confirmation for every
+blocker/major fix.
+
+- [ ] Callback idempotency: a duplicated webhook/callback does not double-charge
+- [ ] Amounts stored as fixed-point (integers/cents), never floats
+- [ ] Currency codes and precision handled correctly
+- [ ] Provider signature / HMAC verification on callbacks
+- [ ] Refund logic: correct reversal, no double-refund
+- [ ] Failure path: payment timeout, declined, retry semantics
+- [ ] Transaction boundary spans charge + order-state update
+- [ ] Sensitive data (PAN, tokens) never logged or masked on output
+- [ ] Ledger/journal entries are append-only and auditable
diff --git a/skills/project-review/references/manual-review/permission.md b/skills/project-review/references/manual-review/permission.md
new file mode 100644
index 0000000..927eb69
--- /dev/null
+++ b/skills/project-review/references/manual-review/permission.md
@@ -0,0 +1,11 @@
+# Permission Module — Manual Review Checklist
+
+High-risk module: authorization changes require product/human confirmation.
+
+- [ ] Every endpoint/action enforces the intended permission — no default-allow
+- [ ] Role hierarchy / scoping (tenant, org, user) is consistent
+- [ ] Object-level permissions checked on read AND write
+- [ ] Deny-before-allow ordering is safe
+- [ ] Permission checks cannot be bypassed via IDs, query params, or bulk ops
+- [ ] New permission/role values handled by all consumers (enum completeness)
+- [ ] Sensitive actions audited with actor + target
diff --git a/skills/project-review/references/report-template.html b/skills/project-review/references/report-template.html
new file mode 100644
index 0000000..bd2bf45
--- /dev/null
+++ b/skills/project-review/references/report-template.html
@@ -0,0 +1,142 @@
+<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>代码审查报告</title>
+<style>
+  :root { --border:#d0d7de; --bg:#f6f8fa; --fg:#1f2328; --muted:#57606a;
+          --good:#1a7f37; --warn:#9a6700; --fail:#cf222e; --na:#57606a;
+          --blocker:#cf222e; --major:#9a6700; --minor:#57606a;
+          --critical:#cf222e; --informational:#0969da; }
+  * { box-sizing: border-box; }
+  body { font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Helvetica,Arial,sans-serif;
+         margin:0; padding:2rem 1rem; color:var(--fg); background:#fff; line-height:1.55; }
+  .wrap { max-width:960px; margin:0 auto; }
+  h1 { font-size:1.5rem; margin:0 0 .25rem; }
+  h2 { font-size:1.1rem; margin:1.5rem 0 .5rem; padding-bottom:.25rem;
+       border-bottom:1px solid var(--border); }
+  .meta { color:var(--muted); font-size:.9rem; margin-bottom:1.5rem; }
+  .verdict { display:inline-block; padding:.25rem .75rem; border-radius:20px;
+             font-weight:700; font-size:.95rem; }
+  .verdict.pass { background:#dafbe1; color:var(--good); }
+  .verdict.fail { background:#ffebe9; color:var(--fail); }
+  table { border-collapse:collapse; width:100%; margin:.75rem 0; }
+  th,td { border:1px solid var(--border); padding:.45rem .6rem; text-align:left;
+          font-size:.9rem; vertical-align:top; }
+  th { background:var(--bg); }
+  .grade.good { color:var(--good); font-weight:600; }
+  .grade.warn { color:var(--warn); font-weight:600; }
+  .grade.fail { color:var(--fail); font-weight:600; }
+  .grade.na { color:var(--na); }
+  .issue { margin:.6rem 0; padding:.65rem .8rem; border:1px solid var(--border);
+           border-radius:6px; background:#fff; }
+  .issue .tag { display:inline-block; padding:.1rem .5rem; border-radius:10px;
+                font-size:.75rem; font-weight:700; color:#fff; margin-right:.5rem; }
+  .tag.blocker, .tag.critical { background:var(--blocker); }
+  .tag.major, .tag.warn { background:var(--major); }
+  .tag.minor, .tag.informational { background:var(--minor); }
+  .issue .cat { font-weight:600; }
+  .issue .loc { color:var(--muted); font-size:.85rem; margin-top:.2rem; }
+  .issue .fix { margin-top:.35rem; font-size:.88rem; background:var(--bg);
+                padding:.4rem .6rem; border-radius:4px; }
+  .muted { color:var(--muted); font-size:.85rem; }
+  code { background:var(--bg); padding:.1rem .3rem; border-radius:4px;
+         font-size:.88em; }
+</style>
+</head>
+<body>
+<div class="wrap" id="app"></div>
+<script>
+const data = {{REPORT_DATA}};
+
+function esc(s) {
+  return String(s ?? "").replace(/[&<>"']/g, c => ({
+    "&":"&amp;", "<":"&lt;", ">":"&gt;", '"':"&quot;", "'":"&#39;"
+  })[c]);
+}
+
+function verdictClass(v) {
+  v = String(v || "").toUpperCase();
+  return v.includes("PASS") ? "pass" : "fail";
+}
+
+const metricLabels = {
+  sql_risk: "SQL 注入风险",
+  exception_coverage: "异常分支覆盖",
+  redundancy_rate: "代码冗余率",
+  high_risk_density: "高风险场景密度",
+  vulnerability_risk: "漏洞风险",
+};
+const gradeLabels = { good: "良好", warn: "警告", fail: "不合格", na: "不适用" };
+const sevLabels = {
+  blocker: "🔴 阻塞", critical: "🔴 严重",
+  major: "🟡 主要", warn: "🟡 主要",
+  minor: "🔵 次要", informational: "🔵 次要",
+};
+
+let html = `<h1>代码审查报告</h1>
+<div class="meta">
+  <span class="verdict ${verdictClass(data.verdict)}">${esc(data.verdict || "无结论")}</span>
+  &nbsp; 档位: <code>${esc(data.tier || "standard")}</code>
+  &nbsp; 范围: <code>${esc(data.scope || "change-level")}</code>
+  ${data.baseline ? `&nbsp; 基线: <code>${esc(data.baseline)}</code>` : ""}
+</div>`;
+if (data.quality_score != null) html += `<p><b>PR 质量分:</b> ${esc(data.quality_score)}/10</p>`;
+if (data.timestamp) html += `<p class="muted">生成时间: ${esc(data.timestamp)}</p>`;
+if (data.files) html += `<p><b>文件:</b> ${esc(data.files)}</p>`;
+if (data.summary) html += `<p>${esc(data.summary)}</p>`;
+
+const metrics = data.metrics || {};
+const mkeys = Object.keys(metrics);
+if (mkeys.length) {
+  html += `<h2>客观指标</h2><table><tr><th>指标</th><th>数值</th><th>评级</th><th>说明</th></tr>`;
+  for (const k of mkeys) {
+    const m = metrics[k] || {};
+    const g = m.grade || "na";
+    const label = metricLabels[k] || k;
+    const gradeText = gradeLabels[g] || g;
+    html += `<tr>
+      <td>${esc(label)}</td>
+      <td>${esc(m.value ?? "N/A")}</td>
+      <td class="grade ${esc(g)}">${esc(gradeText)}</td>
+      <td class="muted">${esc(m.note || "")}</td>
+    </tr>`;
+  }
+  html += `</table>`;
+}
+
+const issues = data.issues || [];
+html += `<h2>问题清单 (${issues.length})</h2>`;
+if (!issues.length) {
+  html += `<p class="muted">未发现问题。</p>`;
+}
+for (const i of issues) {
+  const sev = (i.severity || "minor").toLowerCase();
+  const sevLabel = sevLabels[sev] || i.severity;
+  html += `<div class="issue">
+    <span class="tag ${esc(sev)}">${esc(sevLabel)}</span>
+    <span class="cat">${esc(i.category)}</span>
+    ${esc(i.message || "")}
+    ${i.confidence != null ? `<span class="muted">(置信度 ${esc(i.confidence)}/10)</span>` : ""}
+    ${i.location ? `<div class="loc">→ ${esc(i.location)}</div>` : ""}
+    ${i.fix ? `<div class="fix"><b>修复建议:</b> ${esc(i.fix)}</div>` : ""}
+  </div>`;
+}
+
+const manual = data.manual_review || [];
+if (manual.length) {
+  html += `<h2>需要人工审查</h2><ul>`;
+  for (const m of manual) html += `<li>${esc(m)}</li>`;
+  html += `</ul>`;
+}
+
+const judged = data.llm_judged || [];
+if (judged.length) {
+  html += `<p class="muted"><b>需 LLM 判断的指标:</b> ${judged.map(esc).join(", ")}</p>`;
+}
+
+document.getElementById("app").innerHTML = html;
+</script>
+</body>
+</html>
diff --git a/skills/project-review/references/review-checklist.md b/skills/project-review/references/review-checklist.md
new file mode 100644
index 0000000..fdc4406
--- /dev/null
+++ b/skills/project-review/references/review-checklist.md
@@ -0,0 +1,82 @@
+# Unified Review — Generic Checklist
+
+Reference for the Layer-1 chain decomposition and gstack CRITICAL sub-pass.
+Load the language-specific checklist when available (`java-spring.md`,
+`python-django.md`, `python-fastapi.md`, `node-express.md`, `go-gin.md`,
+`csharp-dotnet.md`, `rust.md`, `php-laravel.md`, `ruby-rails.md`); otherwise
+use this generic list.
+
+## Layer 1 — eight categories
+
+For each changed area mark ✅ Clean / ⚠️ Issues Found / — N/A.
+
+1. **Interface** — parameter validation, response conventions, HTTP status
+   codes, rate limiting, API versioning, protocol correctness
+2. **Business** — logic aligns with requirements, state machine correctness,
+   idempotency design, distributed locks
+3. **Data** — SQL injection, query performance, index usage, transaction
+   boundaries, cache invalidation
+4. **Utility** — input validity, no side effects, error return values,
+   date/time timezone handling
+5. **Error handling** — exception classification, fallback logic, error
+   message sanitization, retry with backoff
+6. **Security** — AuthN/AuthZ, sensitive data masking, permission control,
+   CSRF/XSS prevention
+7. **Performance** — N+1 queries, caching strategy, connection pooling,
+   batch operations, blocking in async paths
+8. **Observability** — structured logging with correlation IDs, metrics,
+   health checks
+
+## gstack CRITICAL sub-pass (highest severity)
+
+### SQL & Data Safety
+- String interpolation in SQL — use parameterized queries
+- TOCTOU check-then-set — use atomic `WHERE` + update
+- Bypassing model validations for direct DB writes
+- N+1 queries — missing eager loading
+
+### Race Conditions & Concurrency
+- Read-check-write without uniqueness constraint / duplicate-key retry
+- find-or-create without a unique DB index
+- Status transitions not atomic (`WHERE old_status = ? UPDATE ...`)
+- Unsafe HTML rendering on user-controlled data
+
+### LLM Output Trust Boundary
+- LLM-generated values (emails, URLs, names) written to DB without format
+  validation
+- Structured tool output accepted without type/shape checks
+- LLM-generated URLs fetched without an allowlist (SSRF)
+- LLM output stored in knowledge bases without sanitization (stored prompt
+  injection)
+
+### Shell Injection
+- `subprocess` with `shell=True` AND interpolated command strings
+- `os.system()` with variable interpolation
+- `eval()`/`exec()` on LLM-generated code without sandboxing
+
+### Enum & Value Completeness
+- New enum/status/tier values: read (not just grep) every consumer that
+  switches/filters/displays the value
+- Check allowlists and `case`/`if-elsif` chains for fall-through
+
+## Suppressions — do NOT flag
+- Harmless redundancy that aids readability
+- "Add a comment explaining a threshold" — thresholds drift
+- Consistency-only changes
+- Anything already addressed in the diff
+
+## Severity
+- 🔴 **blocker** — must fix before merge (injection, secrets, missing
+  transaction, auth bypass) → verdict FAIL
+- 🟡 **major** — should fix before merge (missing validation, missing
+  fallback, N+1, unmasked data)
+- 🔵 **minor** — can optimize later (naming, duplicate code, comments)
+
+## Confidence calibration
+- 9-10 verified by reading specific code
+- 7-8 high-confidence pattern match
+- 5-6 medium — show with caveat
+- 3-4 low — move to appendix
+- 1-2 speculation — suppress unless severity would be P0
+
+Every finding: `[SEVERITY] (confidence: N/10) file:line — problem → fix`.
diff --git a/skills/project-review/references/specialists/api-contract.md b/skills/project-review/references/specialists/api-contract.md
new file mode 100644
index 0000000..1c9baf4
--- /dev/null
+++ b/skills/project-review/references/specialists/api-contract.md
@@ -0,0 +1,13 @@
+# API Contract Specialist
+
+Focus: API and interface contract changes in the diff.
+
+- [ ] Breaking changes to public endpoints (paths, params, response shape)
+- [ ] Versioning compatibility (deprecations, fallbacks)
+- [ ] Request/response validation matches the schema
+- [ ] Error response shape is consistent
+- [ ] Authentication/authorization behavior unchanged for existing consumers
+- [ ] Renamed/moved functions: all callers updated
+
+Output JSON lines:
+`{"severity":"CRITICAL|INFORMATIONAL","confidence":N,"path":"file","line":N,"category":"api-contract","summary":"...","fix":"...","source":"api-contract"}`
diff --git a/skills/project-review/references/specialists/data-migration.md b/skills/project-review/references/specialists/data-migration.md
new file mode 100644
index 0000000..b70be3c
--- /dev/null
+++ b/skills/project-review/references/specialists/data-migration.md
@@ -0,0 +1,15 @@
+# Data Migration Specialist
+
+Focus: database schema and data migrations in the diff.
+
+- [ ] Migration idempotent and re-runnable
+- [ ] Forward + rollback paths defined
+- [ ] Backfill batched / resumable
+- [ ] Type/precision changes do not truncate data
+- [ ] Nullability/default changes safe for existing rows
+- [ ] Application deploy compatible with old + new schema (expand/contract)
+
+Insurance specialist — always runs, even when silent.
+
+Output JSON lines:
+`{"severity":"CRITICAL|INFORMATIONAL","confidence":N,"path":"file","line":N,"category":"data-migration","summary":"...","fix":"...","source":"data-migration"}`
diff --git a/skills/project-review/references/specialists/maintainability.md b/skills/project-review/references/specialists/maintainability.md
new file mode 100644
index 0000000..188f9db
--- /dev/null
+++ b/skills/project-review/references/specialists/maintainability.md
@@ -0,0 +1,16 @@
+# Maintainability Specialist
+
+Focus: code quality and maintainability issues.
+
+- [ ] Dead code / unreachable branches / unused variables
+- [ ] Magic numbers → named constants
+- [ ] Overcomplicated abstractions (indirection without payoff)
+- [ ] Copy-paste blocks that should be shared (only when it aids clarity)
+- [ ] Functions too large / doing too much
+- [ ] Stale comments contradicting the code
+
+Suppress: harmless redundancy that aids readability, comment-on-threshold
+requests, consistency-only changes.
+
+Output JSON lines:
+`{"severity":"CRITICAL|INFORMATIONAL","confidence":N,"path":"file","line":N,"category":"maintainability","summary":"...","fix":"...","source":"maintainability"}`
diff --git a/skills/project-review/references/specialists/performance.md b/skills/project-review/references/specialists/performance.md
new file mode 100644
index 0000000..e95dc73
--- /dev/null
+++ b/skills/project-review/references/specialists/performance.md
@@ -0,0 +1,14 @@
+# Performance Specialist
+
+Focus: performance and resource efficiency in the diff.
+
+- [ ] N+1 queries — missing eager loading
+- [ ] Unindexed lookups in hot loops
+- [ ] O(n×m) lookups in views/loops
+- [ ] Blocking calls in async paths (sync subprocess, requests, sleep)
+- [ ] Connection pool exhaustion, unbounded retries
+- [ ] Bundle/asset size regressions (frontend)
+- [ ] Redundant recomputation / missing caching
+
+Output JSON lines:
+`{"severity":"CRITICAL|INFORMATIONAL","confidence":N,"path":"file","line":N,"category":"performance","summary":"...","fix":"...","source":"performance"}`
diff --git a/skills/project-review/references/specialists/red-team.md b/skills/project-review/references/specialists/red-team.md
new file mode 100644
index 0000000..38746f8
--- /dev/null
+++ b/skills/project-review/references/specialists/red-team.md
@@ -0,0 +1,18 @@
+# Red Team Specialist (conditional)
+
+Focus: find what the primary and specialist reviewers MISSED. Only dispatched
+when the diff is large (>200 lines) or a specialist found a critical issue.
+
+Think like an attacker and a chaos engineer:
+
+- [ ] Cross-cutting concerns the specialist checklists do not cover
+- [ ] Integration boundary failures (service-to-service, module-to-module)
+- [ ] Failure modes: what breaks in production under load, restart, partial
+      failure
+- [ ] Silent data corruption paths (wrong results without errors)
+- [ ] Error handling that swallows failures
+- [ ] Trust boundary violations
+- [ ] Race conditions and edge cases the primary review missed
+
+Be adversarial. No compliments — just the problems. Tag findings with
+`"source":"red-team"`. Output `NO FINDINGS` when nothing new is found.
diff --git a/skills/project-review/references/specialists/security.md b/skills/project-review/references/specialists/security.md
new file mode 100644
index 0000000..429c700
--- /dev/null
+++ b/skills/project-review/references/specialists/security.md
@@ -0,0 +1,17 @@
+# Security Specialist
+
+Focus: security vulnerabilities in the diff.
+
+- [ ] SQL injection (string interpolation, parameterized queries)
+- [ ] AuthN/AuthZ bypasses, missing permission checks
+- [ ] XSS (unsafe HTML rendering on user data)
+- [ ] Sensitive data exposure / missing masking in logs and responses
+- [ ] SSRF (fetching user/LLM-controlled URLs without allowlist)
+- [ ] Command injection (`shell=True` + interpolation)
+- [ ] Hardcoded secrets / credentials
+- [ ] CSRF / missing rate limiting on auth endpoints
+
+Insurance specialist — always runs, even when silent.
+
+Output JSON lines:
+`{"severity":"CRITICAL|INFORMATIONAL","confidence":N,"path":"file","line":N,"category":"security","summary":"...","fix":"...","source":"security"}`
diff --git a/skills/project-review/references/specialists/testing.md b/skills/project-review/references/specialists/testing.md
new file mode 100644
index 0000000..e1e3c84
--- /dev/null
+++ b/skills/project-review/references/specialists/testing.md
@@ -0,0 +1,14 @@
+# Testing Specialist
+
+Focus: test coverage gaps and tests that would catch the issues found.
+
+- [ ] Every changed function has at least a happy-path test
+- [ ] Negative/error paths tested (invalid input, failure branches)
+- [ ] Edge cases mirror the happy-path structure
+- [ ] If the fix for a finding can be caught by a test, propose a minimal
+      `test_stub` (framework-detected: jest/vitest/rspec/pytest/go-test)
+- [ ] Integration coverage for critical flows (DB, external calls)
+- [ ] No assertion-only tests that pass trivially
+
+Output JSON lines:
+`{"severity":"CRITICAL|INFORMATIONAL","confidence":N,"path":"file","line":N,"category":"testing","summary":"...","fix":"...","test_stub":"...","source":"testing"}`
diff --git a/skills/unified-review/SKILL.md b/skills/unified-review/SKILL.md
index 3d38111..32491f5 100644
--- a/skills/unified-review/SKILL.md
+++ b/skills/unified-review/SKILL.md
@@ -53,7 +53,7 @@ Any 🔴 blocker → verdict `❌ FAIL` regardless of other scores. Classify eac
 
 ## Step 8 - Report
 
-Call `generate_report_tool(review_data=<collected verdict, metrics, findings, tier, scope>)` to write `code-review-report.html`.  Also present the text report inline.
+Call `generate_report_tool(review_data=<collected verdict, metrics, findings, tier, scope>)` to write `code-review-report.html` and `code-review-report.md` (default `format="both"`).  Also present the text report inline.
 
 ## Step 9 - Persistence (optional)
 
diff --git a/skills/unified-review/references/report-template.html b/skills/unified-review/references/report-template.html
index 696dadb..bd2bf45 100644
--- a/skills/unified-review/references/report-template.html
+++ b/skills/unified-review/references/report-template.html
@@ -1,9 +1,9 @@
 <!DOCTYPE html>
-<html lang="en">
+<html lang="zh-CN">
 <head>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
-<title>Code Review Report</title>
+<title>代码审查报告</title>
 <style>
   :root { --border:#d0d7de; --bg:#f6f8fa; --fg:#1f2328; --muted:#57606a;
           --good:#1a7f37; --warn:#9a6700; --fail:#cf222e; --na:#57606a;
@@ -61,28 +61,45 @@ function verdictClass(v) {
   return v.includes("PASS") ? "pass" : "fail";
 }
 
-let html = `<h1>Code Review Report</h1>
+const metricLabels = {
+  sql_risk: "SQL 注入风险",
+  exception_coverage: "异常分支覆盖",
+  redundancy_rate: "代码冗余率",
+  high_risk_density: "高风险场景密度",
+  vulnerability_risk: "漏洞风险",
+};
+const gradeLabels = { good: "良好", warn: "警告", fail: "不合格", na: "不适用" };
+const sevLabels = {
+  blocker: "🔴 阻塞", critical: "🔴 严重",
+  major: "🟡 主要", warn: "🟡 主要",
+  minor: "🔵 次要", informational: "🔵 次要",
+};
+
+let html = `<h1>代码审查报告</h1>
 <div class="meta">
-  <span class="verdict ${verdictClass(data.verdict)}">${esc(data.verdict || "NO VERDICT")}</span>
-  &nbsp; Tier: <code>${esc(data.tier || "standard")}</code>
-  &nbsp; Scope: <code>${esc(data.scope || "change-level")}</code>
-  ${data.baseline ? `&nbsp; Baseline: <code>${esc(data.baseline)}</code>` : ""}
+  <span class="verdict ${verdictClass(data.verdict)}">${esc(data.verdict || "无结论")}</span>
+  &nbsp; 档位: <code>${esc(data.tier || "standard")}</code>
+  &nbsp; 范围: <code>${esc(data.scope || "change-level")}</code>
+  ${data.baseline ? `&nbsp; 基线: <code>${esc(data.baseline)}</code>` : ""}
 </div>`;
-if (data.timestamp) html += `<p class="muted">Generated ${esc(data.timestamp)}</p>`;
-if (data.files) html += `<p><b>Files:</b> ${esc(data.files)}</p>`;
+if (data.quality_score != null) html += `<p><b>PR 质量分:</b> ${esc(data.quality_score)}/10</p>`;
+if (data.timestamp) html += `<p class="muted">生成时间: ${esc(data.timestamp)}</p>`;
+if (data.files) html += `<p><b>文件:</b> ${esc(data.files)}</p>`;
 if (data.summary) html += `<p>${esc(data.summary)}</p>`;
 
 const metrics = data.metrics || {};
 const mkeys = Object.keys(metrics);
 if (mkeys.length) {
-  html += `<h2>Objective Metrics</h2><table><tr><th>Metric</th><th>Value</th><th>Grade</th><th>Notes</th></tr>`;
+  html += `<h2>客观指标</h2><table><tr><th>指标</th><th>数值</th><th>评级</th><th>说明</th></tr>`;
   for (const k of mkeys) {
     const m = metrics[k] || {};
     const g = m.grade || "na";
+    const label = metricLabels[k] || k;
+    const gradeText = gradeLabels[g] || g;
     html += `<tr>
-      <td>${esc(k)}</td>
+      <td>${esc(label)}</td>
       <td>${esc(m.value ?? "N/A")}</td>
-      <td class="grade ${esc(g)}">${esc(g)}</td>
+      <td class="grade ${esc(g)}">${esc(gradeText)}</td>
       <td class="muted">${esc(m.note || "")}</td>
     </tr>`;
   }
@@ -90,32 +107,33 @@ if (mkeys.length) {
 }
 
 const issues = data.issues || [];
-html += `<h2>Issues (${issues.length})</h2>`;
+html += `<h2>问题清单 (${issues.length})</h2>`;
 if (!issues.length) {
-  html += `<p class="muted">No issues found.</p>`;
+  html += `<p class="muted">未发现问题。</p>`;
 }
 for (const i of issues) {
   const sev = (i.severity || "minor").toLowerCase();
+  const sevLabel = sevLabels[sev] || i.severity;
   html += `<div class="issue">
-    <span class="tag ${esc(sev)}">${esc(i.severity)}</span>
+    <span class="tag ${esc(sev)}">${esc(sevLabel)}</span>
     <span class="cat">${esc(i.category)}</span>
     ${esc(i.message || "")}
-    ${i.confidence ? `<span class="muted">(confidence ${esc(i.confidence)})</span>` : ""}
+    ${i.confidence != null ? `<span class="muted">(置信度 ${esc(i.confidence)}/10)</span>` : ""}
     ${i.location ? `<div class="loc">→ ${esc(i.location)}</div>` : ""}
-    ${i.fix ? `<div class="fix"><b>Fix:</b> ${esc(i.fix)}</div>` : ""}
+    ${i.fix ? `<div class="fix"><b>修复建议:</b> ${esc(i.fix)}</div>` : ""}
   </div>`;
 }
 
 const manual = data.manual_review || [];
 if (manual.length) {
-  html += `<h2>Manual Review Required</h2><ul>`;
+  html += `<h2>需要人工审查</h2><ul>`;
   for (const m of manual) html += `<li>${esc(m)}</li>`;
   html += `</ul>`;
 }
 
 const judged = data.llm_judged || [];
 if (judged.length) {
-  html += `<p class="muted"><b>LLM-judged:</b> ${judged.map(esc).join(", ")}</p>`;
+  html += `<p class="muted"><b>需 LLM 判断的指标:</b> ${judged.map(esc).join(", ")}</p>`;
 }
 
 document.getElementById("app").innerHTML = html;
diff --git a/tests/test_project_review.py b/tests/test_project_review.py
new file mode 100644
index 0000000..a9e4cd4
--- /dev/null
+++ b/tests/test_project_review.py
@@ -0,0 +1,60 @@
+"""Tests for the project-review workflow (whole-project / feature scope)."""
+
+from __future__ import annotations
+
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).parent.parent))
+
+from fastmcp.prompts.prompt import Message  # noqa: E402
+
+from code_review_graph.prompts import project_review_prompt  # noqa: E402
+
+
+def _text(msg: Message) -> str:
+    return msg.content.text
+
+
+class TestProjectReviewPromptRendering:
+    def test_whole_project_renders_full_workflow(self):
+        text = _text(project_review_prompt()[0])
+        # Header + shared steps 1-4 must all be present.
+        assert "## Project Review Workflow" in text
+        assert "scope=whole-project" in text
+        assert "1. Call" in text
+        assert "4. Locate high-risk" in text
+        # whole-project branch uses all_files=True.
+        assert "all_files=True" in text
+        assert "get_knowledge_gaps" in text
+
+    def test_feature_renders_feature_branch(self):
+        text = _text(project_review_prompt(scope="feature", target="checkout")[0])
+        assert "scope=feature" in text
+        assert "target=checkout" in text
+        # Shared steps 1-4 must still be present (no truncation).
+        assert "4. Locate high-risk" in text
+        # Feature branch: semantic search + impact radius, not all_files.
+        assert "semantic_search_nodes" in text
+        assert "get_impact_radius" in text
+        assert "all_files=True" not in text
+
+    def test_default_scope_is_whole_project(self):
+        text = _text(project_review_prompt()[0])
+        assert "scope=whole-project" in text
+
+    def test_read_only_present(self):
+        text = _text(project_review_prompt()[0])
+        assert "READ-ONLY" in text
+
+    def test_both_branches_have_preamble(self):
+        assert "get_minimal_context" in _text(project_review_prompt()[0])
+        assert "get_minimal_context" in _text(
+            project_review_prompt(scope="feature", target="auth")[0]
+        )
+
+    def test_both_branches_end_with_report_step(self):
+        whole = _text(project_review_prompt()[0])
+        feat = _text(project_review_prompt(scope="feature", target="x")[0])
+        assert "generate_report" in whole
+        assert "generate_report" in feat
diff --git a/tests/test_prompts.py b/tests/test_prompts.py
index 856eb46..18c3899 100644
--- a/tests/test_prompts.py
+++ b/tests/test_prompts.py
@@ -7,6 +7,7 @@ from code_review_graph.prompts import (
     debug_issue_prompt,
     onboard_developer_prompt,
     pre_merge_check_prompt,
+    project_review_prompt,
     review_changes_prompt,
     unified_review_prompt,
 )
@@ -214,6 +215,58 @@ class TestUnifiedReviewPrompt:
         assert "FAIL" in _text(result[0])
 
 
+class TestProjectReviewPrompt:
+    def test_returns_list_with_messages(self):
+        result = project_review_prompt()
+        assert isinstance(result, list)
+        assert len(result) >= 1
+
+    def test_message_has_role_and_content(self):
+        result = project_review_prompt()
+        for msg in result:
+            assert isinstance(msg, Message)
+            assert msg.role == "user"
+            assert _text(msg)
+
+    def test_default_whole_project_scope(self):
+        result = project_review_prompt()
+        text = _text(result[0])
+        assert "whole-project" in text
+        assert "all_files=True" in text
+
+    def test_feature_scope_with_target(self):
+        result = project_review_prompt(scope="feature", target="payment")
+        text = _text(result[0])
+        assert "scope=feature" in text
+        assert "target=payment" in text
+
+    def test_mentions_architecture_scan(self):
+        result = project_review_prompt()
+        text = _text(result[0])
+        assert "get_architecture_overview" in text
+        assert "list_communities" in text
+
+    def test_mentions_high_risk_scan(self):
+        result = project_review_prompt()
+        text = _text(result[0])
+        assert "get_knowledge_gaps" in text
+        assert "get_hub_nodes" in text
+
+    def test_feature_mentions_semantic_search(self):
+        result = project_review_prompt(scope="feature", target="auth")
+        text = _text(result[0])
+        assert "semantic_search_nodes" in text
+        assert "get_impact_radius" in text
+
+    def test_mentions_read_only(self):
+        result = project_review_prompt()
+        assert "READ-ONLY" in _text(result[0])
+
+    def test_mentions_generate_report(self):
+        result = project_review_prompt()
+        assert "generate_report" in _text(result[0])
+
+
 class TestTokenEfficiencyPreamble:
     """All prompts should include the token efficiency preamble."""
 
@@ -241,3 +294,7 @@ class TestTokenEfficiencyPreamble:
     def test_unified_review_has_preamble(self):
         result = unified_review_prompt()
         assert "get_minimal_context" in _text(result[0])
+
+    def test_project_review_has_preamble(self):
+        result = project_review_prompt()
+        assert "get_minimal_context" in _text(result[0])
diff --git a/tests/test_report.py b/tests/test_report.py
index c40e277..ed85bca 100644
--- a/tests/test_report.py
+++ b/tests/test_report.py
@@ -1,4 +1,4 @@
-"""Tests for the unified-review HTML report tool."""
+"""Tests for the unified-review HTML/Markdown report tool."""
 
 from __future__ import annotations
 
@@ -9,13 +9,14 @@ import pytest
 
 sys.path.insert(0, str(Path(__file__).parent.parent))
 
-from code_review_graph.scoring import build_report_data  # noqa: E402
+from code_review_graph.scoring import (  # noqa: E402
+    build_report_data,
+    render_markdown_report,
+)
 from code_review_graph.tools.scoring_tools import (  # noqa: E402
     _load_report_template,
     generate_report_func,
 )
-
-
 def _review_data() -> dict:
     return {
         "scope": "change-level",
@@ -24,6 +25,8 @@ def _review_data() -> dict:
         "files": "app.py, main.py",
         "baseline": "generic",
         "verdict": "\u2705 PASS",
+        "quality_score": 7.0,
+        "counts": {"critical": 1, "informational": 2},
         "metrics": {
             "sql_risk": {"value": 0, "grade": "good", "note": "heuristic"},
             "exception_coverage": {"value": 33.33, "grade": "warn", "note": "heuristic"},
@@ -44,6 +47,11 @@ def _review_data() -> dict:
     }
 
 
+def _mkroot(tmp_path: Path) -> Path:
+    Path(tmp_path, ".code-review-graph").mkdir(exist_ok=True)
+    return tmp_path
+
+
 class TestBuildReportData:
     def test_normalises_review_data(self):
         data = build_report_data(_review_data())
@@ -55,6 +63,11 @@ class TestBuildReportData:
         assert data["issues"][0]["location"] == "src/app.py:42"
         assert "requirement_coverage" in data["llm_judged"]
 
+    def test_quality_score_and_counts_carried(self):
+        data = build_report_data(_review_data())
+        assert data["quality_score"] == 7.0
+        assert data["counts"] == {"critical": 1, "informational": 2}
+
     def test_empty_findings(self):
         rd = _review_data()
         rd["findings"] = []
@@ -76,29 +89,108 @@ class TestLoadTemplate:
         assert template.startswith("<!DOCTYPE html>")
 
 
+class TestRenderMarkdownReport:
+    def test_renders_chinese_structure(self):
+        md = render_markdown_report(_review_data())
+        assert "# 代码审查报告" in md
+        assert "结论" in md
+        assert "PR 质量分" in md and "7.0/10" in md
+        assert "客观指标" in md
+        assert "SQL 注入风险" in md
+        assert "异常分支覆盖" in md
+        assert "问题清单" in md
+        assert "🟡 主要" in md
+        assert "置信度 7/10" in md
+        assert "修复建议" in md
+        assert "需要人工审查" in md
+        assert "Payment callback idempotency" in md
+        assert "需 LLM 判断的指标" in md
+
+    def test_grade_localisation(self):
+        rd = _review_data()
+        rd["metrics"] = {
+            "sql_risk": {"value": 0, "grade": "good"},
+            "vulnerability_risk": {"value": 2, "grade": "fail"},
+            "high_risk_density": {"value": None, "grade": "na"},
+        }
+        md = render_markdown_report(rd)
+        assert "良好" in md
+        assert "不合格" in md
+        assert "不适用" in md
+
+    def test_empty_report(self):
+        md = render_markdown_report({})
+        assert "# 代码审查报告" in md
+        assert "未发现问题" in md
+
+
 class TestGenerateReport:
-    def test_writes_self_contained_html(self, tmp_path):
-        Path(tmp_path, ".code-review-graph").mkdir(exist_ok=True)
-        out = tmp_path / "sub" / "report.html"
+    def test_both_writes_html_and_md(self, tmp_path):
+        root = _mkroot(tmp_path)
         result = generate_report_func(
             _review_data(),
-            output_path=str(out),
-            repo_root=str(tmp_path),
+            output_path="sub/report",
+            repo_root=str(root),
         )
         assert result["status"] == "ok"
-        assert Path(result["output_path"]).is_file()
-        html = Path(result["output_path"]).read_text(encoding="utf-8")
-        assert "{{REPORT_DATA}}" not in html
-        assert "\u2705 PASS" in html
-        assert "N+1" in html
+        assert isinstance(result["output_path"], list)
+        assert len(result["files"]) == 2
+        html = root / "sub" / "report.html"
+        md = root / "sub" / "report.md"
+        assert html.is_file()
+        assert md.is_file()
+        html_text = html.read_text(encoding="utf-8")
+        md_text = md.read_text(encoding="utf-8")
+        assert "{{REPORT_DATA}}" not in html_text
+        assert "代码审查报告" in html_text
+        assert "\u2705 PASS" in html_text
+        assert "N+1" in html_text
+        assert "# 代码审查报告" in md_text
+
+    def test_markdown_only(self, tmp_path):
+        root = _mkroot(tmp_path)
+        result = generate_report_func(
+            _review_data(),
+            output_path="md-only",
+            repo_root=str(root),
+            format="markdown",
+        )
+        assert result["status"] == "ok"
+        assert len(result["files"]) == 1
+        assert str(result["output_path"]).endswith("md-only.md")
+        assert (root / "md-only.md").is_file()
+        assert not (root / "md-only.html").exists()
+
+    def test_html_only(self, tmp_path):
+        root = _mkroot(tmp_path)
+        result = generate_report_func(
+            _review_data(),
+            output_path="html-only",
+            repo_root=str(root),
+            format="html",
+        )
+        assert result["status"] == "ok"
+        assert len(result["files"]) == 1
+        assert str(result["output_path"]).endswith("html-only.html")
+        assert (root / "html-only.html").is_file()
+        assert not (root / "html-only.md").exists()
 
     def test_default_output_path_is_repo_root(self, tmp_path):
-        # repo_root must look like a project root: create .code-review-graph.
-        Path(tmp_path, ".code-review-graph").mkdir(exist_ok=True)
-        result = generate_report_func(_review_data(), repo_root=str(tmp_path))
+        root = _mkroot(tmp_path)
+        result = generate_report_func(_review_data(), repo_root=str(root))
         assert result["status"] == "ok"
-        assert result["output_path"].endswith("code-review-report.html")
-        assert Path(result["output_path"]).is_file()
+        assert (root / "code-review-report.html").is_file()
+        assert (root / "code-review-report.md").is_file()
+
+    def test_invalid_format_errors(self, tmp_path):
+        root = _mkroot(tmp_path)
+        result = generate_report_func(
+            _review_data(),
+            repo_root=str(root),
+            format="xml",
+        )
+        assert result["status"] == "error"
+        assert "xml" in result["error"]
 
     def test_handles_missing_repo_root(self, tmp_path):
         with pytest.raises(ValueError):
diff --git a/tests/test_skills.py b/tests/test_skills.py
index dfa6f07..ec2a01e 100644
--- a/tests/test_skills.py
+++ b/tests/test_skills.py
@@ -118,12 +118,13 @@ class TestGenerateSkills:
         assert result.is_dir()
         assert result == tmp_path / ".claude" / "skills"
 
-    def test_creates_five_skill_subdirs(self, tmp_path):
+    def test_creates_six_skill_subdirs(self, tmp_path):
         skills_dir = generate_skills(tmp_path)
         subdirs = sorted(f.name for f in skills_dir.iterdir() if f.is_dir())
         assert subdirs == [
             "debug-issue",
             "explore-codebase",
+            "project-review",
             "refactor-safely",
             "review-changes",
             "unified-review",
@@ -153,6 +154,7 @@ class TestGenerateSkills:
         for skill_name in (
             "debug-issue",
             "explore-codebase",
+            "project-review",
             "refactor-safely",
             "review-changes",
             "unified-review",
@@ -169,7 +171,7 @@ class TestGenerateSkills:
         result = generate_skills(tmp_path, skills_dir=custom)
         assert result == custom
         assert result.is_dir()
-        assert len(list(result.iterdir())) == 5
+        assert len(list(result.iterdir())) == 6
 
     def test_skill_content_includes_get_minimal_context(self, tmp_path):
         """Every skill template must reference get_minimal_context."""
@@ -194,7 +196,7 @@ class TestGenerateSkills:
         generate_skills(tmp_path)
         generate_skills(tmp_path)
         skills_dir = tmp_path / ".claude" / "skills"
-        assert len(list(skills_dir.iterdir())) == 5
+        assert len(list(skills_dir.iterdir())) == 6
 
 
 class TestGenerateHooksConfig:
@@ -859,8 +861,10 @@ class TestCodeBuddyPlatform:
         assert {path.name for path in skills_root.iterdir()} == {
             "debug-issue",
             "explore-codebase",
+            "project-review",
             "refactor-safely",
             "review-changes",
+            "unified-review",
         }
         for skill_dir in skills_root.iterdir():
             content = (skill_dir / "SKILL.md").read_text(encoding="utf-8")
diff --git a/tests/test_unified_review.py b/tests/test_unified_review.py
index 4667671..f58430e 100644
--- a/tests/test_unified_review.py
+++ b/tests/test_unified_review.py
@@ -31,6 +31,19 @@ class TestToolRegistration:
         ):
             assert hasattr(m, name), f"{name} not exposed by main module"
 
+    def test_project_review_prompt_exposed(self):
+        import code_review_graph.main as m
+
+        assert hasattr(m, "project_review"), "project_review prompt not exposed"
+
+    def test_score_review_has_all_files_param(self):
+        import inspect
+
+        import code_review_graph.main as m
+
+        sig = inspect.signature(m.score_review_tool)
+        assert "all_files" in sig.parameters
+
 
 class TestDocsSections:
     def test_unified_review_section(self):
@@ -61,7 +74,23 @@ class TestGenerateSkills:
         assert "get_minimal_context" in content
         assert "detail_level" in content
 
+    def test_project_review_generated(self, tmp_path):
+        from code_review_graph.skills import generate_skills
+
+        skills_dir = generate_skills(tmp_path)
+        skill_file = skills_dir / "project-review" / "SKILL.md"
+        assert skill_file.is_file()
+        content = skill_file.read_text(encoding="utf-8")
+        assert "all_files=True" in content
+        assert "get_minimal_context" in content
+        assert "detail_level" in content
+
     def test_uninstall_knows_unified_review(self):
         from code_review_graph.uninstall import _generated_skill_slugs
 
         assert "unified-review" in _generated_skill_slugs()
+
+    def test_uninstall_knows_project_review(self):
+        from code_review_graph.uninstall import _generated_skill_slugs
+
+        assert "project-review" in _generated_skill_slugs()