| name | code-review |
| description | Six-dimension structured code review framework. Produces severity-ranked findings (CRITICAL/HIGH/MEDIUM/LOW/INFO) with evidence mapped to AC IDs, and a verdict (APPROVE/REQUEST_CHANGES/NEEDS_DISCUSSION). Used by kopi-reviewer agent. |
| license | MIT |
| allowed-tools | ["file-search","mcp__github__authenticate"] |
code-review
Six-dimension structured code review framework.
Dimensions
1. Correctness
Logic errors against AC criteria, off-by-one, null/undefined handling, race conditions, missing error propagation.
2. OWASP Top 10
A01 Broken Access Control, A02 Crypto Failures, A03 Injection (SQL/XSS/command), A07 Auth Failures, A09 Logging Failures (no PII in logs).
3. AC Coverage
For each must-priority AC: code implements it + test asserts it. Missing must AC → HIGH finding.
4. Accessibility (WCAG 2.1 AA)
Alt text, ARIA labels, color contrast ≥ 4.5:1, keyboard navigation, focus management.
5. Test Hygiene
Business logic changes have unit tests, no mocking implementation details, no arbitrary setTimeout, Given/When/Then test descriptions.
6. Cross-repo Contracts
API response shapes match TypeScript interfaces, breaking changes flagged, versioning conventions followed (constitution Article III).
Severity Thresholds
| Severity | Description |
|---|
| CRITICAL | Security vulnerability, data corruption risk |
| HIGH | Bug causing wrong AC behavior, missing must AC |
| MEDIUM | Code smell, missing should AC, accessibility gap |
| LOW | Style issue, missing could AC gap |
| INFO | Suggestion only |
Finding Template
**[{severity}]** `{file}:{line}` — {description}
AC: {ac_id if applicable}
Suggestion: {concrete fix}
Verdict Logic
CRITICAL or HIGH present → REQUEST_CHANGES
MEDIUM only → NEEDS_DISCUSSION
LOW/INFO only or zero → APPROVE
Output
Findings feed artifacts/active/reviewer-report-{taskId}.json under kopi-reviewer. That artifact conforms to contracts/reviewer-report.schema.json and requires artifact_type, artifact_version, task_id, trace_id, verdict, findings, generated_at, generated_by, and generated_by_model.
