Review
Purpose
Find actionable correctness, compatibility, security, reliability, and maintainability defects in the requested change or scope. Review is read-only.
Workspace protocol
Read references/workspaces.md once per agent task before selecting or creating workflow artifacts; reuse it unless repository scope or task authority changes. This skill owns only the task-specific behavior below.
Inputs
- Review baseline and target: diff, commit, branch, files, or stated behavior
- Requirements, acceptance criteria, applicable instructions, tests, and runtime evidence
- Existing findings and decision records
Outputs
- Findings ordered
critical, high, medium, then low
- Each finding includes a stable ID, severity, category, location, evidence, impact, reasoning or reproduction, and remediation direction
- Residual risks and verification gaps; explicitly state when no actionable findings remain
Workflow
- Establish the exact baseline, target, requirements, and review boundary.
- Inspect the complete current diff or artifact before forming a verdict; do not rely on an assumed stale state.
- Trace affected runtime, data, compatibility, and failure paths beyond the diff when needed to prove impact.
- Evaluate relevant tests and runtime evidence, including important behavior the change leaves untested.
- Compare observed behavior with acceptance criteria, public contracts, and repository rules.
- Read
references/finding-rubric.md, then return only findings with calibrated severity, evidence_status, and structured evidence bound to the reviewed HEAD, or explicitly state that no actionable findings remain. Preserve impact severity when evidence is insufficient; mark the evidence insufficient instead of downgrading it.
Guardrails
- Prioritize defects over style preferences. Do not invent issues for report completeness.
- Distinguish verified defects from questions and speculative risks.
- Do not modify code or mark a finding fixed without evidence.
- When called by an orchestrating loop, perform one bounded review pass and return. Never invoke or request another review, fix, delivery, bugfix, or delegated workflow; only the parent decides the next phase.
Decision-log updates
Record only review-scope interpretations or accepted risk decisions that future work must preserve.
When durable state is approved, track defects and their lifecycle in the selected work item's findings.md and append only review-scope or accepted-risk decisions to decisions.md; otherwise report them in the final response.
Escalate to the human
Escalate when the baseline is ambiguous and changes the verdict, required evidence is inaccessible, a suspected critical issue could expose users or data, or the review requires live destructive testing. Otherwise complete the strongest safe review and disclose the gap.
1---2name: review3description: Use for a general objective code, diff, PR, or fix review without edits; use architecture-review or security-review when either is the primary assessment objective.4---56# Review78## Purpose910Find actionable correctness, compatibility, security, reliability, and maintainability defects in the requested change or scope. Review is read-only.1112## Workspace protocol1314Read `references/workspaces.md` once per agent task before selecting or creating workflow artifacts; reuse it unless repository scope or task authority changes. This skill owns only the task-specific behavior below.1516## Inputs1718- Review baseline and target: diff, commit, branch, files, or stated behavior19- Requirements, acceptance criteria, applicable instructions, tests, and runtime evidence20- Existing findings and decision records2122## Outputs2324- Findings ordered `critical`, `high`, `medium`, then `low`25- Each finding includes a stable ID, severity, category, location, evidence, impact, reasoning or reproduction, and remediation direction26- Residual risks and verification gaps; explicitly state when no actionable findings remain2728## Workflow29301. Establish the exact baseline, target, requirements, and review boundary.312. Inspect the complete current diff or artifact before forming a verdict; do not rely on an assumed stale state.323. Trace affected runtime, data, compatibility, and failure paths beyond the diff when needed to prove impact.334. Evaluate relevant tests and runtime evidence, including important behavior the change leaves untested.345. Compare observed behavior with acceptance criteria, public contracts, and repository rules.356. Read `references/finding-rubric.md`, then return only findings with calibrated severity, `evidence_status`, and structured evidence bound to the reviewed HEAD, or explicitly state that no actionable findings remain. Preserve impact severity when evidence is insufficient; mark the evidence insufficient instead of downgrading it.3637## Guardrails3839- Prioritize defects over style preferences. Do not invent issues for report completeness.40- Distinguish verified defects from questions and speculative risks.41- Do not modify code or mark a finding fixed without evidence.42- When called by an orchestrating loop, perform one bounded review pass and return. Never invoke or request another review, fix, delivery, bugfix, or delegated workflow; only the parent decides the next phase.4344## Decision-log updates4546Record only review-scope interpretations or accepted risk decisions that future work must preserve.47When durable state is approved, track defects and their lifecycle in the selected work item's findings.md and append only review-scope or accepted-risk decisions to decisions.md; otherwise report them in the final response.4849## Escalate to the human5051Escalate when the baseline is ambiguous and changes the verdict, required evidence is inaccessible, a suspected critical issue could expose users or data, or the review requires live destructive testing. Otherwise complete the strongest safe review and disclose the gap.
nono911