# Code Review

> Project-level code review: check changed files against LangWatch codebase rules (IDs, multitenancy, layering, naming, SRP).

- Skill: `langwatch/code-review` (Agent Skill)
- Install (CLI): `npx skillmds@latest add langwatch/code-review`
- Raw SKILL.md: https://api.skillmd.com/api/skills/langwatch/code-review/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: langwatch (https://skillmd.com/u/langwatch)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/langwatch/code-review

---


Review code changes and sign off on each rule below.

**What to diff:** If `$ARGUMENTS` is provided, use it as the diff target (a branch, commit range, or raw diff). Otherwise diff against `origin/main`, or the PR base branch if on a PR branch. If ambiguous, ask.

For each rule: **PASS** if no violations, or **FAIL** with every violation listed — one per line with `file:line`.

## Rules

1. **KSUID only — no uuid/nanoid.** The project uses `@langwatch/ksuid`. No imports of `uuid`, `nanoid`, or `crypto.randomUUID`.

2. **No foreign keys in Prisma migrations.** Prisma relations handle referential integrity. No `REFERENCES`, `FOREIGN KEY`, or `ADD CONSTRAINT.*FOREIGN` in `.sql` migration files.

3. **Prisma queries include projectId.** Every `findMany`/`findFirst`/`findUnique`/`update`/`delete` on project-scoped models must have `projectId` in the `where` clause. Skip: `User`, `Organization`, `OrganizationUser`, `Session`, `Account`, `VerificationToken`.

4. **ClickHouse queries include TenantId.** Every ClickHouse query must filter by `TenantId` in the WHERE clause.

5. **No TypeScript `any`.** No `: any`, `as any`, `<any>`, or `any[]` in added code. Ignore comments and eslint-disable lines.

6. **No hardcoded schema names in migrations.** No `"langwatch_db".` or other schema prefixes in `.sql` files. Use unqualified table names.

7. **Hooks don't return JSX.** Files matching `use*.ts` (not `.tsx`) must not return JSX. Hooks return state/callbacks only.

8. **No re-exports for backwards compatibility.** `export { X } from` or `export * from` shims are not allowed — update consumers directly. (New public API re-exports are fine.)

9. **Layer violations (route → service → repository).** Routes must not import from repositories. Services must not import another domain's repositories directly. Repositories must not import from services. See `src/server/app-layer/`.

10. **Repository/service method naming.** Repositories use `findAll`/`findById` (not `list*`/`get*`). Services use `getAll`/`getById` (not `find*`).

11. **Single Responsibility.** New files should not mix concerns (e.g. HTTP + business logic, data fetching + rendering). One primary export per file. Flag functions over ~100 lines.

12. **Skills must have scenario tests.** Any PR that adds or modifies a skill (`skills/*/SKILL.md`) or MCP tools (`mcp/typescript/src/tools/`) must include corresponding scenario tests in `specs/skills/skills-testing.feature`. New tool handlers need at least one `@integration` scenario covering the happy path.

## Output format

```text
### 1. KSUID only (no uuid/nanoid) — PASS

### 2. No FK in migrations — FAIL
- FOREIGN KEY in `migrations/001_init.sql:45`
- ADD CONSTRAINT FOREIGN in `migrations/002_add.sql:12`

### 3. projectId in Prisma queries — FAIL
- `findMany` without projectId in `src/api.ts:33`

### 4. TenantId in ClickHouse queries — PASS

...
```