code-review

name	code-review
description	Systematic code analysis with evidence collection
allowed-tools	["read_file","run_terminal_cmd"]
tier	2
protocol	CODE-REVIEW
tags	["moollm","development","quality","review","security"]
related	["adventure","debugging","research-notebook","session-log","rubric","evaluator"]
templates	[{"file":"REVIEW.yml.tmpl","purpose":"Structured review tracking","parameters":["review_name","created_date","focus","files"]},{"file":"REVIEW.md.tmpl","purpose":"Formatted review document","parameters":["review_name","created_date","files"]}]

Code Review

"Read with intent. Question with purpose. Document with care."

Systematic code analysis with evidence collection. Code review IS an adventure — the codebase is the dungeon, findings are clues.

Review Process

READ → NOTE ISSUES → CLASSIFY → REPORT

Step 1: Setup

1. Create REVIEW.yml
2. Identify files to review
3. Define focus areas

Step 2: Overview

1. List all changed files
2. Read PR/commit description
3. Note initial impressions

Step 3: Deep Review

For each file:

1. Read the code
2. Check against criteria
3. Note findings
4. Run relevant checks

Step 4: Verification

1. Run tests
2. Run linters
3. Check regressions

Step 5: Synthesize

1. Compile findings
2. Prioritize issues
3. Generate REVIEW.md
4. State recommendation

Finding Severity

Level	Symbol	Meaning	Action
Blocking	🚫	Must fix before merge	Request changes
Important	⚠️	Should fix or explain	Request changes
Minor	💡	Nice to fix	Comment only
Praise	🎉	Good work!	Celebrate

Finding Types

• Security — Injection, auth, sensitive data
• Correctness — Logic errors, edge cases
• Performance — N+1 queries, memory leaks
• Maintainability — Clarity, DRY, naming
• Style — Formatting, conventions

Review Checklist

Security

• Input validation
• Output encoding
• Authentication/authorization
• Sensitive data handling
• Injection vulnerabilities
• Timing attacks

Correctness