Code Review Protocol
How Reviews Arrive
MaksPM spawns you via sessions_spawn with a review request. Your output auto-announces back to MaksPM when done.
Expected Review Request Format
FORGE REVIEW REQUEST
Project: [name]
Repo: [path]
Changed files: [list or "full project"]
Type: [new-build | feature | bugfix | refactor]
Stack: [Next.js | Expo | API-only | full-stack]
Supabase tables affected: [list or "none"]
Auth changes: [yes/no]
Notes: [focus areas]
If the request doesn't follow this format, still review — extract what you can.
Review Process
- Read ALL code first — understand the full picture before flagging anything
- Check developer-patterns — front-load checks for Maks's known blind spots
- Run 8-point checklist:
- Security (auth, RLS, secrets, injection, CORS)
- Type Safety (any, assertions, missing types, Zod coverage)
- Architecture (component structure, server/client boundary, data flow)
- Data Integrity (validation, null handling, race conditions, error states)
- Performance (N+1, re-renders, bundle size, missing indexes)
- Error Handling (unhandled promises, try/catch, user-facing errors, loading/empty states)
- Accessibility & SEO (alt text, headings, ARIA, meta, contrast)
- Code Quality (naming, duplication, dead code, complexity)
- Cross-reference framework source repos for pattern validation
- Run threat model — think like an attacker
- Write verdict using standard format
- Generate auto-fix for every WARNING or BLOCKED issue
- Save to review-history/ —
review-YYYY-MM-DD-[project].md
- Update developer-patterns — add new issues, check for recurring patterns
Verdict Format
## Forge Review — [Project] — [Date]
**Verdict**: ✅ APPROVED / ⚠️ APPROVED WITH WARNINGS / ❌ BLOCKED
### Security: PASS / [n issues]
### Types: PASS / [n issues]
### Architecture: PASS / [n issues]
### Data: PASS / [n issues]
### Performance: PASS / [n issues]
### Error Handling: PASS / [n issues]
### A11y/SEO: PASS / [n issues]
### Code Quality: PASS / [n issues]
### Issues
[#. SEVERITY | file:line | issue | fix]
### Threat Model
[Attack vectors considered and their status]
### What's Done Well
[Positive reinforcement — list strengths]
### Auto-Fix
[Complete corrected code for every WARNING/BLOCKED issue]
Severity Levels
- P0 (🚨 BLOCKED): Security vuln, auth bypass, data exposure, crash risk, COPPA violation
- P1 (🚨 BLOCKED): Broken core flow, data loss risk, missing RLS on user tables
- P2 (⚠️ WARNING): Type gaps, missing validation, performance issue, accessibility gap
- P3 (ℹ️ INFO): Naming, style, minor optimization — never blocks
Review Scope by Type
- new-build: Full 8-point review, every file
- feature: Changed files + security surface area
- bugfix: Verify fix is correct, check for regressions
- refactor: Architecture + type safety + no behavior change
After Every Review
- Save review to
review-history/review-YYYY-MM-DD-[project].md
- Update
developer-patterns with new issues found
- If same issue appears 3+ times → flag it as a blind spot pattern
Changelog
- 2026-03-21: Restored full version with structured handoff, threat model, auto-fix requirement
- 2026-03-20: Initial protocol
1---2name: code-review-protocol3description: Forge's standard operating procedure for receiving and executing code reviews.4---56# Code Review Protocol78## How Reviews Arrive910MaksPM spawns you via sessions_spawn with a review request. Your output auto-announces back to MaksPM when done.1112## Expected Review Request Format1314```15FORGE REVIEW REQUEST16Project: [name]17Repo: [path]18Changed files: [list or "full project"]19Type: [new-build | feature | bugfix | refactor]20Stack: [Next.js | Expo | API-only | full-stack]21Supabase tables affected: [list or "none"]22Auth changes: [yes/no]23Notes: [focus areas]24```2526If the request doesn't follow this format, still review — extract what you can.2728## Review Process29301. **Read ALL code first** — understand the full picture before flagging anything312. **Check developer-patterns** — front-load checks for Maks's known blind spots323. **Run 8-point checklist:**33 - Security (auth, RLS, secrets, injection, CORS)34 - Type Safety (any, assertions, missing types, Zod coverage)35 - Architecture (component structure, server/client boundary, data flow)36 - Data Integrity (validation, null handling, race conditions, error states)37 - Performance (N+1, re-renders, bundle size, missing indexes)38 - Error Handling (unhandled promises, try/catch, user-facing errors, loading/empty states)39 - Accessibility & SEO (alt text, headings, ARIA, meta, contrast)40 - Code Quality (naming, duplication, dead code, complexity)414. **Cross-reference framework source repos** for pattern validation425. **Run threat model** — think like an attacker436. **Write verdict** using standard format447. **Generate auto-fix** for every WARNING or BLOCKED issue458. **Save to review-history/** — `review-YYYY-MM-DD-[project].md`469. **Update developer-patterns** — add new issues, check for recurring patterns4748## Verdict Format4950```51## Forge Review — [Project] — [Date]5253**Verdict**: ✅ APPROVED / ⚠️ APPROVED WITH WARNINGS / ❌ BLOCKED5455### Security: PASS / [n issues]56### Types: PASS / [n issues]57### Architecture: PASS / [n issues]58### Data: PASS / [n issues]59### Performance: PASS / [n issues]60### Error Handling: PASS / [n issues]61### A11y/SEO: PASS / [n issues]62### Code Quality: PASS / [n issues]6364### Issues65[#. SEVERITY | file:line | issue | fix]6667### Threat Model68[Attack vectors considered and their status]6970### What's Done Well71[Positive reinforcement — list strengths]7273### Auto-Fix74[Complete corrected code for every WARNING/BLOCKED issue]75```7677## Severity Levels78- **P0** (🚨 BLOCKED): Security vuln, auth bypass, data exposure, crash risk, COPPA violation79- **P1** (🚨 BLOCKED): Broken core flow, data loss risk, missing RLS on user tables80- **P2** (⚠️ WARNING): Type gaps, missing validation, performance issue, accessibility gap81- **P3** (ℹ️ INFO): Naming, style, minor optimization — never blocks8283## Review Scope by Type84- **new-build**: Full 8-point review, every file85- **feature**: Changed files + security surface area86- **bugfix**: Verify fix is correct, check for regressions87- **refactor**: Architecture + type safety + no behavior change8889## After Every Review901. Save review to `review-history/review-YYYY-MM-DD-[project].md`912. Update `developer-patterns` with new issues found923. If same issue appears 3+ times → flag it as a blind spot pattern9394## Changelog95- 2026-03-21: Restored full version with structured handoff, threat model, auto-fix requirement96- 2026-03-20: Initial protocol
nickgallick