| name | human-review-routing |
| description | Route risky patches to the right reviewer — security, backend, infra, or domain owner — by change type. |
| origin | FlowDeck |
Human Review Routing
When a patch is flagged as review-required or high-risk by the Patch Trust Score, it must be routed to the right human reviewer. This skill defines the routing logic.
Reviewer Types and Triggers
| Reviewer | Triggered by |
|---|
| security | auth, token, password, crypto, secret, jwt, permission, rbac, xss, sql |
| backend | api, route, controller, service, database, query, migration |
| infra | docker, kubernetes, terraform, ci, cd, deploy, helm, nginx, aws, gcp |
| domain-owner | business, billing, payment, checkout, order, subscription, pricing |
| frontend | component, css, html, react, vue, ui, ux, style |
| data | schema, migration, model, index, constraint, foreign key |
| devops | pipeline, workflow, .yml, .yaml, action, cron, schedule |
Routing Logic
- Scan the changed file paths and change description for keywords from the table above
- Check the Patch Trust Score verdict
- High-risk always adds
security to the reviewer list
- Multiple reviewer types can be assigned to one patch
- If no keywords match and verdict is
safe, route to general-reviewer
Workflow
Provide the files and change description to the agent to get the routing decision.
Example input:
Review route for: files=src/services/auth.ts,src/api/payment.ts change=refactor JWT validation
Output:
Route to: security, backend, domain-owner
Trust verdict: review-required
Review Request Format
When routing a patch, include:
## Review Request
**Patch**: [brief description]
**Files**: [list]
**Trust Score**: [score] ([verdict])
**Route to**: [reviewer types]
**Reason**: [why this routing]
**Deadline**: [if blocking release]
### Key areas to check
- [specific concern 1]
- [specific concern 2]
Escalation
If no appropriate reviewer is available within 24h, escalate to the tech lead. Never merge a high-risk patch without at least one human approval.
