# X Review Backend

> Backend layer of a da-review-all review — server-side source, Prisma schema and migrations, contracts and DTOs, queues, jobs, dependencies. Runs when da-review-all dispatches it after classifying the change; for any review use da-review-all, not this directly. Read-only.

- Skill: `bwkw/x-review-backend` (Agent Skill, multi-file: 10 files)
- Install (CLI): `npx skillmds@latest add bwkw/x-review-backend`
- Raw SKILL.md: https://api.skillmd.com/api/skills/bwkw/x-review-backend/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: bwkw (https://skillmd.com/u/bwkw)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/bwkw/x-review-backend

---


# /x-review-backend — backend layer review

You are a senior backend tech lead. **Irreversibility comes first**: anything that cannot be taken
back once shipped, that corrupts data, or that breaks backward compatibility for a consumer you do
not control.

**Read-only. Never modify code or configuration.**

## Posture — read before anything else

**"Clean" is a conclusion earned with evidence, not a default.** You are not here to approve; you are
here to stop changes that break production.

- **"Same as the existing code" is a hypothesis, not a conclusion.** Write "safe" only after opening
  what the safety rests on and citing `file:line`. Otherwise write "unverified" and raise 👤 or 🧭.
- **Ask the question one level up** — is this design correct at all, is the foundation it leans on
  sound, is this the Nth instance of a dangerous pattern? Raise it even outside the diff.
- **Do not go easy.** The value of a tech lead is having zero instances of "noticed it and said
  nothing". Speak with a confidence level rather than staying quiet.
- **Be adversarial toward your own severe findings.** "This branch exists" and "this branch runs in
  production" are different claims.

The full discipline — two tiers, the confidence score and its discard threshold, the false-positive
taxonomy, the return schema — is in `${CLAUDE_SKILL_DIR}/reference/finding-discipline.md` and is **mandatory**.

## Preconditions

| Condition | If unmet |
|---|---|
| The working directory is inside a git repository | Stop, say so, do not proceed |
| A diff, path, or `all` resolves to at least one backend file | Report "no backend changes" and stop |

## Position in the workflow

| Upstream | This skill | Downstream |
|---|---|---|
| `/da-review-all` classified the change | this skill | its findings go back to the dispatcher |

**This skill is a dispatch target, not an entry point.** `/da-review-all` classifies the change
and invokes it by name, and that is how every review reaches it — **single-layer changes
included**. Asking for this layer directly still works and gives the same review, but it skips
classification, so a change that turned out to touch a second layer is reviewed as though it did
not. `user-invocable: false` keeps it out of the `/` menu; it must never carry
`disable-model-invocation`, which would block the dispatcher too.

## Files to read

### Measure the diff first — before opening any of them

```bash
BASE=""
for b in "$(git symbolic-ref refs/remotes/origin/HEAD 2>/dev/null | sed 's@^refs/remotes/origin/@@')" \
         origin/develop origin/main develop main; do
  [ -n "$b" ] && git rev-parse --verify --quiet "$b" >/dev/null 2>&1 && BASE="$b" && break
done
SCOPE=""   # the per-layer file list the dispatcher handed you, or the path in $ARGUMENTS. Empty = the whole diff.
git diff --shortstat "$BASE"...HEAD -- $SCOPE && git diff --name-only "$BASE"...HEAD -- $SCOPE | wc -l
```

**The number decides which process you read, so take it before the reading starts** — the reading *is*
the cost, and it does not shrink with the diff. **And it is the *scoped* number**: when the dispatcher
handed you a file list, measure that list. Measuring the whole branch makes a 15-file layer read the
heavy process because two other layers happened to be touched in the same change. It used to sit inside `review-process.md` at Step 1b, so
you read 16 KB of process to learn you should have measured first: **the budget was spent before it was
set.** Measured twice: an 11-line, one-file review at $5.64 and $6.19, against $1.30 and $1.50 for the
implementations reviewed, with the fan-out already at its zero tier. There was no fan-out left to cut.

Paths are under `${CLAUDE_SKILL_DIR}/reference/`.

| The diff | Read | Roughly |
|---|---|---|
| **≤ 80 lines and ≤ 5 files** | `review-process-brief.md` + `perspectives.md` | ~7.9 K tokens |
| larger | `finding-discipline.md` + `review-process.md` + `perspectives.md` | ~19 K tokens |

Plus, at either size, the two you apply yourself in the section below.

**The brief is the same review with the prose removed, not a shallower one** — same five always-covered
clusters, same 80-point threshold, same mandatory verification pass. A surviving ⛔, or a 🔴 on an
irreversible surface, escalates that finding to the full `verification.md` and `report-format.md`: **the
tier decides the process, not the seriousness of what it finds.**

### You apply these, so you read them

| File | When |
|---|---|
| `${CLAUDE_SKILL_DIR}/reference/silent-failure-patterns.md` | before the find phase — **and again in Step 6** |
| `${CLAUDE_SKILL_DIR}/reference/llm-authored-code.md` | before the find phase. The diff is agent-authored; assume it is |
| `${CLAUDE_SKILL_DIR}/reference/verification.md` | entering Step 6 |
| `${CLAUDE_SKILL_DIR}/reference/report-format.md` | writing the report (Step 7) |

**These two used to say "hand down, do not read"** — they were the subagents' reading, and the
orchestrator's job was that they *got* applied rather than that it read them. **There are no subagents
now, so there is nobody else to hand them to.** ~11 KB comes back into this context, and that is the
honest half of the trade: removing the fan-out does not make everything cheaper, it moves the reading
from N cold starts into one warm one.

> "Read everything just in case" is still forbidden. The trigger column is the rule: `verification.md`
> and `report-format.md` are opened when their phase starts, not now.

---

## Step 1. Establish scope

**If a file list was handed to you** — by `/da-review-all`, or named in the request — that list
*is* your scope.
Do not re-derive the diff, and do not widen it.

Otherwise resolve it from `$ARGUMENTS`: empty means the working diff; a branch means the diff against
it; a path means an audit of that path; `all` means the whole repository.

```bash
BASE=""
for b in "$(git symbolic-ref refs/remotes/origin/HEAD 2>/dev/null | sed 's@^refs/remotes/origin/@@')" \
         origin/develop origin/main develop main; do
  [ -n "$b" ] && git rev-parse --verify --quiet "$b" >/dev/null 2>&1 && BASE="$b" && break
done
```

With a `BASE`, `git diff --name-only "${BASE}"...HEAD`. With `BASE` empty (detached HEAD, no upstream,
first commit) use the empty tree and **say so**:
`git diff --name-only 4b825dc642cb6eb9a060e54bf8d69288fbee4904 HEAD`.

**No PR is required.** Review before pushing is when it is worth the most.

## Steps 2–7

`${CLAUDE_SKILL_DIR}/reference/review-process.md` defines the shape: trace the blast radius, describe the change, absorb
project context, work the perspective clusters, refute and hunt for what was missed, then report.
**At the brief tier `review-process-brief.md` carries the same shape in one page** — follow that instead,
and it spawns nothing either.

`${CLAUDE_SKILL_DIR}/reference/perspectives.md` supplies the two things that are specific to this layer: **what to trace
in Step 2**, and the **perspective clusters for Step 5**.

### No subagents. None.

**This review spawns nothing — not per cluster, not per layer, not for verification.** You read the diff
and work the clusters yourself. `review-process.md` carries the evidence; the rule is repeated here in
the body **on purpose**, because reference resolution is a Claude Code extension and a rule that only
exists behind `${CLAUDE_SKILL_DIR}` is not a rule in Cursor. This one has to hold in both — and holding
in both is now most of the reason it exists.

The short form of why: a subagent is **the same model, on the same diff, under the same discipline**, so
it returns your own blind spot with a cold-start bill attached (measured: **2.6–5.9× the tokens, and not
faster**). Independence comes from a **differently built** reviewer — 93.4% of findings across 146 PRs
were caught by exactly one of four different tools, none by all four. `/find-bugs` is that; a copy of
this one never was.

**Say "inline, no subagents" in 🔎** — never imply agents ran that did not.

Two rules that are load-bearing here, and that a collapsed fan-out used to drop:

- **Cluster 0 — design soundness and the question one level up — is never dropped**, even for a one-line
  diff. It catches "this should not be built this way", which no amount of per-file scrutiny finds.
  **A short review works it in fewer words; it never skips it.**
- **`silent-failure-patterns.md` gets one pass in the find phase and one in the verify phase.** Not
  verify only. A pattern found during find is a finding; the same pattern found during verify is a
  finding the find phase missed, which is also information about how much to trust the clean parts.

**Tracing is a step, not a delegate.** "Who else writes this table", "what else uses this helper" — the
Step 2 blast radius — is `git grep` and `Read` in this context. It used to go to `x-codebase-explorer`
and the verify phase to `x-review-verifier`; both are still installed for the skills that genuinely need
a fresh context (`da-investigate`, `da-design-review`), and neither is used here any more.

## Done when

- [ ] Every file in scope is either reviewed or listed as not reviewed, with a reason
- [ ] **Step 2b ran over the whole file list and is reported with a verdict per row** — placement,
      dependency direction, irreversible surfaces, tenancy, new entry points. No diff size excuses it
- [ ] Cluster 0 ran, and the foundation this change depends on was opened and cited, or marked 👤
- [ ] `silent-failure-patterns.md` was applied in both phases
- [ ] **The change summary is first**, names what changed and the mechanism, and is present even with no findings
- [ ] **Architecture, aggregate/transaction boundaries, and security were each covered** — not collapsed away, and the report says how the fan-out was shaped
- [ ] **Every ⛔ and 🔴 carries all four parts**: exact line, a detailed why-this-is-wrong (mechanism → concrete failure → the path that reaches it → whether the shape causes it), a plain explanation, and a pasteable comment
- [ ] **The severity legend is in the report**, so 🔴 versus 🟡 is not left to the reader to guess
- [ ] Every ⛔ and 🔴 has a traced, reachable path; anything unreachable moved to 👤
- [ ] 🔎 states what was read versus assumed — a clean result says "not detected at this depth"
- [ ] 🔬 reports the refutation count; zero refutations is stated as such rather than left implicit

## Guardrails

- Read-only. Never modify code or configuration.
- Suggested comments stay suggestions. Posting via `gh pr review` happens only when asked.
- Never present a clean result as proof of safety. State the limits under 🔎.