review-verification-protocol

name	review-verification-protocol
description	Mandatory verification steps for all code reviews to reduce false positives. Load this skill before reporting ANY code review findings.

Review Verification Protocol

This protocol MUST be followed before reporting any code review finding. Skipping these steps leads to false positives that waste developer time and erode trust in reviews.

Pre-Report Verification Checklist

Before flagging ANY issue, verify:

• I read the actual code - Not just the diff context, but the full function/class
• I searched for usages - Before claiming "unused", searched all references
• I checked surrounding code - The issue may be handled elsewhere (guards, earlier checks)
• I verified syntax against current docs - Framework syntax evolves (Tailwind v4, TS 5.x, React 19)
• I distinguished "wrong" from "different style" - Both approaches may be valid
• I considered intentional design - Checked comments, CLAUDE.md, architectural context

Verification by Issue Type

"Unused Variable/Function"

Before flagging, you MUST:

1. Search for ALL references in the codebase (grep/find)
2. Check if it's exported and used by external consumers
3. Check if it's used via reflection, decorators, or dynamic dispatch
4. Verify it's not a callback passed to a framework

Common false positives:

• State setters in React (may trigger re-renders even if value appears unused)
• Variables used in templates/JSX
• Exports used by consuming packages

"Missing Validation/Error Handling"

Before flagging, you MUST:

1. Check if validation exists at a higher level (caller, middleware, route handler)
2. Check if the framework provides validation (Pydantic, Zod, TypeScript)
3. Verify the "missing" check isn't present in a different form

Common false positives:

• Framework already validates (FastAPI + Pydantic, React Hook Form)
• Parent component validates before passing props
• Error boundary catches at higher level

"Type Assertion/Unsafe Cast"

Before flagging, you MUST:

1. Confirm it's actually an assertion, not an annotation
2. Check if the type is narrowed by runtime checks before the point
3. Verify if framework guarantees the type (loader data, form data)

Valid patterns often flagged incorrectly:

// Type annotation, NOT forced unwrap
let data: UserData = await loader()

// Type narrowing makes this safe
if let user = data as? User {
  user.name  // Swift knows this is User
}

"Potential Memory Leak/Race Condition"

Before flagging, you MUST:

1. Verify cleanup function is actually missing (not just in a different location)
2. Check if AbortController signal is checked after awaits
3. Confirm the component can actually unmount during the async operation

Common false positives:

• Cleanup exists in useEffect return
• Signal is checked (code reviewer missed it)
• Operation completes before unmount is possible

"Performance Issue"

Before flagging, you MUST:

1. Confirm the code runs frequently enough to matter (render vs click handler)
2. Verify the optimization would have measurable impact
3. Check if the framework already optimizes this (React compiler, memoization)

Do NOT flag:

• Functions created in click handlers (runs once per click)
• Array methods on small arrays (< 100 items)
• Object creation in event handlers

Severity Calibration

Critical (Block Merge)

ONLY use for:

• Security vulnerabilities (injection, auth bypass, data exposure)
• Data corruption bugs
• Crash-causing bugs in happy path
• Breaking changes to public APIs

Major (Should Fix)

Use for:

• Logic bugs that affect functionality
• Missing error handling that causes poor UX
• Performance issues with measurable impact
• Accessibility violations

Minor (Consider Fixing)

Use for:

• Code clarity improvements
• Documentation gaps
• Inconsistent style (within reason)
• Non-critical test coverage gaps

Do NOT Flag At All

• Style preferences where both approaches are valid
• Optimizations with no measurable benefit
• Test code not meeting production standards (intentionally simpler)
• Library/framework internal code (shadcn components, generated code)
• Hypothetical issues that require unlikely conditions

Valid Patterns (Do NOT Flag)

Swift

Pattern	Why It's Valid
guard let early return	Standard Swift pattern for unwrapping, not excessive nesting
weak self in closures	Required for breaking retain cycles, not unnecessary
@State / @Binding property wrappers	SwiftUI state management primitives
Optional chaining (foo?.bar?.baz)	Safe access pattern, not error suppression
as? conditional cast	Safer than force cast, correct for type narrowing

SwiftUI

Pattern	Why It's Valid
@StateObject in parent, @ObservedObject in child	Correct ownership pattern
View body computed property without caching	SwiftUI manages re-rendering efficiently
AnyView for heterogeneous lists	Valid when @ViewBuilder or generics aren't practical
EnvironmentObject injection	Standard SwiftUI dependency injection
PreferenceKey for child-to-parent data	Correct alternative to callbacks for layout data

Testing

Pattern	Why It's Valid
XCTAssertEqual without custom message	Default messages are often sufficient
async let in test methods	Valid for concurrent test setup
@MainActor test classes	Required when testing UI-bound code
Mock objects without protocol conformance	Simple test doubles are acceptable

General

Pattern	Why It's Valid
+? lazy quantifier in regex	Prevents over-matching, correct for many patterns
Direct string concatenation	Simpler than template literals for simple cases
Multiple returns in function	Can improve readability
Comments explaining "why"	Better than no comments

Context-Sensitive Rules

Swift Optionals

Flag force unwrap (!) ONLY IF ALL of these are true:

• Value CAN actually be nil at runtime
• No prior guard let or if let protects the access
• Not in test code or prototype
• Not a @IBOutlet (which is conventionally force-unwrapped)

View Body Complexity

Flag complex View body ONLY IF:

• Body exceeds 40 lines
• Nested components could be extracted without losing clarity
• Performance profiling shows actual rendering issues
• Not a leaf view with minimal composition

Error Handling

Flag missing do/catch ONLY IF:

• No Result type wraps the throwing call
• No higher-level error handler catches this
• The error would cause a crash, not just a failed operation
• User needs specific feedback for this error type

Before Submitting Review

Final verification:

1. Re-read each finding and ask: "Did I verify this is actually an issue?"
2. For each finding, can you point to the specific line that proves the issue exists?
3. Would a domain expert agree this is a problem, or is it a style preference?
4. Does fixing this provide real value, or is it busywork?
5. Format every finding as: [FILE:LINE] ISSUE_TITLE

If uncertain about any finding, either:

• Remove it from the review
• Mark it as a question rather than an issue
• Verify by reading more code context