Menu
Review implementation against the plan and contract. Distinguish code bugs from contract gaps. Bounded convergence.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Handle cvg-code-review blocker findings in the worker session. Validate feedback, repair implementation-owned issues, or stop for plan and contract gaps.
Handle cvg-plan-review blocker findings in the planner session. Validate feedback, revise plan-owned artifacts, or stop for missing decisions.
Review a plan against the actual codebase. Verify slices are sufficient, surfaces are complete, and invariants are correct.
Create a plan for the assigned issue. Reads issue scope and codebase, produces a plan document with slices and invariant matrix when the work is cross-cutting.
Execute the plan slice by slice using TDD. Self-check completeness before declaring the implementation result.
Orchestrate a monitored Codex implementation loop with a worker, code reviewers, actor-local review feedback handling, QA gates, callback transport, heartbeat waiting, and strict fresh-reviewer exit conditions.
| name | cvg-code-review |
| description | Review implementation against the plan and contract. Distinguish code bugs from contract gaps. Bounded convergence. |
Review the implementation against the plan. The goal is to verify that the plan's criteria are met and no P0/P1 bugs were introduced. Converge in as few rounds as possible.
The task context provides the plan path and the current implementation head. Read the plan, any linked behavior contract, and the diff.
Read project stage guidance from the task context before applying this skill.
For code review, stage affects P1/P2 severity and merge-blocking criteria; contract gaps still block. Stage can calibrate whether missing edge-case resilience is blocking, but it cannot excuse an unmet plan criterion, missing real surface, broken error propagation.
Read:
docs/impl-notes/<issue-id>.md, if present; read
this before the diff to understand why the implementation looks the way it doesgit diff <base>..HEAD)Write a 2-3 line intent summary after reading the plan and implementation notes. This anchors the review.
Intent: Enforce sandbox receipt rejection across all billing entry points.
Must not regress existing production billing flows. Eight surfaces in the
invariant matrix must all pass.
Dispatch sub-agent reviewers in parallel with your own step 4 review.
Always dispatch (both in parallel):
cvg-correctness-reviewer - "Review for logic errors, edge cases, state bugs,
error propagation. Intent: . Plan: . Base: ."cvg-testing-reviewer - "Review for coverage gaps, weak assertions, brittle
tests. Intent: . Plan: . Base: ."When diff touches auth, public endpoints, user input, permissions, or data handling:
cvg-security-reviewer - "Review for security vulnerabilities. Intent:
. Plan: . Base: ."When diff is large (>=50 changed lines) or touches auth, payments, data mutations, or external APIs:
cvg-adversarial-reviewer - "Review for failure scenarios and abuse cases.
Intent: . Plan: . Base: ."When diff touches error handling, retries, timeouts, or background jobs:
cvg-reliability-reviewer - "Review for production reliability issues.
Intent: . Plan: . Base: ."When auxiliary delegation is available, run the relevant reviewers in parallel. If it is not available, perform the same checks yourself.
When dispatching auxiliary reviewers, include the project stage and the domain-risk override rule in the sub-agent prompt.
Sub-agent findings merge with yours in step 5.
Check in order:
Slice completion: For each slice, verify its "done when" criterion is met. Missing or incomplete slice = blocking finding.
Invariant matrix (cross-cutting plans): For each cell, verify the invariant is enforced on that surface and a test exists. Check ALL cells in ONE pass; if 3 are missing, capture all 3.
Implementation correctness: In changed code, look for P0 (critical breakage, data loss, security) and P1 (bugs in normal usage, contract violations).
Merge sub-agent findings with your own. Deduplicate by file+line, keep highest severity on overlap. Classify each as:
Code bug - the plan says to do X, the code does X wrong.
Contract gap - the plan is missing something the implementation reveals is needed.
Pre-existing issue - the problem existed before this change.
Treating a contract gap as a code bug causes whack-a-mole.
Use one of these verdicts:
For "not ready", include every blocking finding you can see in one pass. For "ready with fixes", include P2s as non-blocking notes and do not loop on them.
Same-reviewer recheck is exhaustive within recheck scope: verify the old findings, check the fix diff and newly changed code for new P0/P1 issues, and include all new issues in one pass.