| name | code-review |
| description | Review code and data pipeline changes for correctness, security, performance, maintainability, contract breaks, and missing verification. Use before merge, after implementation, for PRs, commits, pending diffs, or codebase risk scans. |
Code Review
Review adversarially. Findings require evidence from code, diff, tests, or runtime behavior.
Scope Resolution
- PR or URL: review PR diff.
- Commit hash: review that commit.
--pending: review staged and unstaged changes.codebase: scan broader architecture/risk surface.- No explicit target: review recent changes in context or ask for target.
Review Order
- Establish scope and changed files.
- Check requirement/spec compliance.
- Scout affected dependents and edge cases.
- Review correctness, contracts, security, performance, tests.
- Separate blocking findings from non-blocking observations.
Checklist
- Contract breaks: API, schema, grain, metric, config, behavior.
- Error handling: no silent swallowing or hidden partial failure.
- Validation: inputs checked at trust and data boundaries.
- Security: no secrets, PII leaks, injection, auth/authz gaps.
- Data correctness: idempotency, schema evolution, quality gates, reconciliation.
- Performance: query fan-out, Spark collect/cartesian/skew, unbounded loops.
- Maintainability: clear ownership, no duplicated business logic, no speculative abstraction.
- Verification: tests or direct checks prove the changed behavior.
Severity
- Critical: security exposure, data loss, breaking contract, irreversible damage.
- High: likely production failure, wrong results, missing required verification.
- Medium: maintainability or performance risk with plausible impact.
- Low: style or cleanup that does not block.
Output
Lead with findings:
Findings:
- [Critical|High|Medium|Low] file:line - issue, impact, evidence, fix
Open questions:
- ...
Summary:
- Reviewed: <scope>
- Verification observed: <commands/results or missing>
