faffter-noon-spec-review

name	faffter-noon-spec-review
description	Default `spec_review` slot occupant — the L1–L3 single-pass spec reviewer. Runs four lenses (architectural / infosec / methodology / QA) as one checklist pass over a freshly-rated spec and emits a founded `faff-contract:spec-review-verdict` block. Runs as a configured slot, not the user `/` menu.
judgement_seam	spec-verdict
user-invocable	false

faffter-noon-spec-review

The default occupant of the spec_review slot — the L1–L3 single-pass approach reviewer. It is the judgement layer of the spec stage: it challenges the approach itself (sound? safe? right-sized? verifiable?) while the work is still just a spec, before any code exists. faff-prep invokes it once after the spec is confidence-rated and before promote-to-Todo, then pipes its verdict through faff contract spec-review-verdict and routes on the result.

When standalone, Read the sibling faff/SKILL.md (the gateway) first — it holds the shared rules and the fixed contracts. This recap is non-normative; the gateway wins.

What it does

One LLM pass walks the selected lenses as a checklist over the spec, gathers {lens, severity} objections, maps them to a single verdict, and emits one contract block. It is not an adversarial review — that costlier per-lens refuter form is a separate occupant. The consumer's lens-selection step (the change-surface cost-gate) chooses which of the four lenses fire; this pass runs exactly that set. With no lens-set passed, all four fire (the back-compatible default) — selection only ever removes a lens on a confidently-safe surface, and infosec + QA always fire at L1–L3.

The contract (faff contract spec-review-verdict) validates the verdict's shape only. This producer owns the reasoning — the lenses and the severity→verdict roll-up below. Do not re-validate shape here; emit a conformant block and let the consumer pipe it.

Inputs

The consumer passes:

• The spec body (the freshly-produced, confidence-rated spec).
• The selected lens-set + mode from the consumer's change-surface lens-selection step. Fire exactly the named lenses; absent a set, fire all four. mode is single-pass here (the adversarial mode routes to the L4 occupant).
• The attached ## Methodology critique block, when prep wrote one (the methodology slot's already-computed value/scope signal).
• Repo architecture context, including docs/adr/ for cross-slice decisions.

The four lenses (single-pass checklist)

Lens	Asks	Source it draws on
architectural	Is the design sound? Does it fit the system? Is there a simpler/cheaper design? Are cross-slice decisions ADR-worthy and consistent with existing ADRs?	The spec body + repo architecture + docs/adr/.
infosec	What is the threat surface? authz/authn, secrets handling, blast radius.	A generic security checklist — no learned per-repo threat prior.
methodology	Right-sized? Right increment? Worth doing now?	Consumes the attached ## Methodology critique. It never re-derives value/scope/risk.
QA	Is it verifiable? Can we tell when it is done and right?	The spec's scenarios / DONE criteria.

Severities are blocker / major / minor. Emit at most one objection per lens (the lens's worst finding); a lens with no finding contributes none.

Methodology lens — consume, never recompute. Read the attached critique and translate it into at most one methodology objection (e.g. a critique flagging a too-large slice → a methodology blocker on scope). It must issue zero value/scope re-derivation. If no ## Methodology critique block is present (prep ran with no methodology slot), the lens degrades to "no signal available", emits no methodology objection, and notes the gap — it never falls back to recomputing value or scope.

The verdict roll-up (severity → verdict)

After gathering objections, apply this deterministic map (a producer-local heuristic, not a contract rule):

PROCEDURE map_verdict(objections):
  IF objections is empty:                          → approve
  IF any objection is a blocker:
     IF the blocking lens is architectural         → reject-approach   # design wrong, right scope → prep re-specs
     IF the blocking lens is methodology (scope)   → reject-approach   # wrong increment → plot re-slices
     IF the blocking lens is infosec               → needs-human       # threat calls need a human at L1–L3
     IF the blocking lens is QA                     → revise            # unverifiable → add scenarios/DoD in place
  ELSE (only major/minor objections, no blocker)   → revise            # fixable in place

The founded-verdict invariant (enforced by the contract): approve carries zero objections; every other verdict carries at least one. Keep the emitted objections consistent with the verdict — when a blocker drives the verdict, that blocker is in the array.

Where a reject-approach routes (prep vs plot) is the consumer's concern, read off the objecting lens — this producer just emits the founded verdict.

Output (the contract artifact)

Emit exactly one fenced block as the producer's output — the consumer (faff-prep) locates it, JSON.parses it, and pipes it to faff contract spec-review-verdict (the sole source of contract data):

{ "verdict": "approve", "objections": [] }

Examples of a founded non-approve verdict:

{ "verdict": "reject-approach", "objections": [ { "lens": "architectural", "severity": "blocker" } ] }

{ "verdict": "revise", "objections": [ { "lens": "QA", "severity": "major" } ] }

The fixed verdict shape (approve / revise / reject-approach / needs-human, plus objections: [{ lens, severity }] over the enums architectural|infosec|methodology|QA × blocker|major|minor) and its validation live in the gateway's contract-as-code surface. A swapped-in reviewer (e.g. an adversarial per-lens occupant) conforms by emitting the same block.

Level gradient (the cost-stable boundary)

Review depth scales by level, all mapping onto the one spec-review-verdict contract:

• L1–L3 — this skill: one single-pass 4-lens checklist, one founded verdict.
• L4 — independent per-lens adversarial refuters, each prompted to refute the spec from its angle, gated on majority/severity (a separate occupant in the same slot).
• Depth/cost scales with level + appetite + change-surface; selective per-lens firing by change-surface is the consumer's cost-gate (it passes the lens-set this pass fires). v1 is additive-only: only the low-risk lenses are skippable, infosec + QA always fire at L1–L3, and an uncertain surface fires all four.

This skill ships the L1–L3 form and leaves the L4 hook.