scan-code-review-rules

name	scan-code-review-rules
description	[Documentation] Use when scanning code conventions, anti-patterns, architecture rules, and review checklists.

Codex compatibility note:

• Invoke repository skills with $skill-name in Codex; this mirrored copy rewrites legacy Claude /skill-name references.
• Task tracker mandate: BEFORE executing any workflow or skill step, create/update task tracking for all steps and keep it synchronized as progress changes.
• User-question prompts mean to ask the user directly in Codex.
• Ignore Claude-specific mode-switch instructions when they appear.
• Strict execution contract: when a user explicitly invokes a skill, execute that skill protocol as written.
• Subagent authorization: when a skill is user-invoked or AI-detected and its protocol requires subagents, that skill activation authorizes use of the required spawn_agent subagent(s) for that task.
• Do not skip, reorder, or merge protocol steps unless the user explicitly approves the deviation first.
• For workflow skills, execute each listed child-skill step explicitly and report step-by-step evidence.
• If a required step/tool cannot run in this environment, stop and ask the user before adapting.

Codex Project-Reference Loading (No Hooks)

Codex does not receive Claude hook-based doc injection. When coding, planning, debugging, testing, or reviewing, open project docs explicitly using this routing.

Always read:

• docs/project-config.json (project-specific paths, commands, modules, and workflow/test settings)
• docs/project-reference/docs-index-reference.md (routes to the full docs/project-reference/* catalog)
• docs/project-reference/lessons.md (always-on guardrails and anti-patterns)

Missing-file hard stop: If docs/project-config.json, the docs index, lessons.md, or any task-required reference doc is missing, stop immediately and ask the user to run $project-config and $scan-all.

Situation-based docs:

• Backend/CQRS/API/domain/entity changes: backend-patterns-reference.md, domain-entities-reference.md, project-structure-reference.md
• Frontend/UI/styling/design-system: frontend-patterns-reference.md, scss-styling-guide.md, design-system/README.md
• Spec/test-case planning or TC mapping: feature-docs-reference.md
• Integration test implementation/review: integration-test-reference.md
• E2E test implementation/review: e2e-test-reference.md
• Code review/audit work: code-review-rules.md plus domain docs above based on changed files

Do not read all docs blindly. Start from docs-index-reference.md, then open only relevant files for the task.

Quick Summary

Goal: Scan project codebase for established conventions, lint rules, common patterns, and anti-patterns → populate docs/project-reference/code-review-rules.md with actionable review rules and checklists. (read directly when relevant; do not rely on hook-injected conversation text)

Workflow:

1. Classify — Detect project scope, scan mode
2. Scan — Discover conventions and patterns via parallel sub-agents
3. Report — Write findings to external report file (incremental)
4. Generate — Build/update reference doc from report
5. Verify — Fresh-eyes round validates rules against actual code

Key Rules:

• Derive rules from ACTUAL codebase patterns, not generic best practices
• Every rule has a "DO" example from the project with file:line
• Focus on project-specific conventions that differ from framework defaults MUST ATTENTION detect project scope FIRST — agent routing depends on it

---

Scan Code Review Rules

Phase 0: Classify Scan Scope

Before any other step, run in parallel:

1. Read docs/project-reference/code-review-rules.md

   • Detect mode: Init (placeholder) or Sync (populated)
   • In Sync mode: extract section list → skip re-scanning well-documented sections

2. Detect project scope:

Signal	Scope	Agent Routing
.csproj files present	Full-stack or Backend-only	Run Agent 1 (Backend)
angular.json / nx.json / package.json with framework	Frontend present	Run Agent 2 (Frontend)
Both above	Full-stack	Run Agents 1+2+3
docker-compose.yml / K8s manifests	Infrastructure present	Run Agent 3 (Architecture)
Linter configs (.eslintrc, stylecop.json)	Code quality infra found	Prioritize Agent 1/2

3. Discover code quality infrastructure:
   • Linter configs (.eslintrc, .editorconfig, stylecop.json, .prettierrc, ruff.toml)
   • CI quality gates, code analysis configs (SonarQube, CodeClimate)
   • Existing standards docs (CONTRIBUTING.md, CODING_STANDARDS.md)
   • Git hooks (pre-commit, husky)

Evidence gate: Confidence <60% on scope → report uncertainty, ask user before proceeding.

Phase 1: Plan

Create task tracking entries for each sub-agent and each review dimension. Do not start Phase 2 without tasks created.

Phase 2: Execute Scan (Parallel Sub-Agents)

Launch sub-agents matching detected scope. Each MUST:

• Write findings incrementally after each section — NEVER batch at end
• Cite file:line for every rule example
• Confidence: HIGH (3+ consistent examples), MEDIUM (1-2), LOW (<1) — document HIGH and MEDIUM only

All findings → plans/reports/scan-code-review-rules-{YYMMDD}-{HHMM}-report.md

Agent 1: Backend Rules

Think: What does a GOOD backend file look like in this project? What naming, error handling, and DI choices separate "good code" from "code that got merged but shouldn't have"? Where are the active anti-patterns?

Scan targets:

• Naming conventions — class suffixes, method prefixes, interface naming with examples
• Base classes — when used vs when not used (detect violations)
• Error handling — try-catch, Result types, error middleware patterns
• Dependency injection — registration conventions, lifetime choices
• Anti-patterns — direct DB access from controllers, business logic in wrong layer
• Logging — structured logging, log levels, correlation IDs

Agent 2: Frontend Rules

Think: What makes Angular/React/Vue code reviewable vs unmaintainable here? Where is state management discipline enforced? What cleanup patterns are used?

Scan targets:

• Component conventions — naming, file organization, template patterns with examples
• State management — what goes in store vs component vs service (with rule evidence)
• Styling — BEM, CSS modules, utility classes, naming (derive from detected approach)
• Subscription/memory management — cleanup, unsubscribe, dispose patterns
• Accessibility — ARIA, semantic HTML, keyboard navigation (if patterns found)
• Performance — lazy loading, change detection, memoization patterns

Agent 3: Architecture Rules

Think: What dependency directions are enforced here? Where do services communicate directly vs via messages? What's shared vs duplicated, and is that intentional?

Scan targets:

• Layer boundaries — what imports what, dependency direction rules
• Cross-service communication — direct calls vs messages (find violations)
• Shared code — what's shared vs duplicated, rationale
• Testing conventions — naming, organization, mock patterns
• Security — auth checks, input validation, output encoding (derive from existing patterns)
• Configuration — env vars, config files, secrets management patterns

Phase 3: Analyze & Generate

Read report. Apply evidence confidence to classify each rule:

Confidence	Documentation
HIGH (3+ examples, consistent)	Document as rule with DO/DON'T pair
MEDIUM (1-2 examples)	Document as "observed pattern (verify)"
LOW (<1 consistent example)	Omit — insufficient evidence

Round 1 (main agent): Build section drafts from report.

Round 2 (fresh sub-agent, zero memory): Re-reads report + draft independently.

• Does every decision tree node have real code examples?
• Are anti-patterns documented with real file:line violations (not hypothetical)?
• Is every rule specific to this project (not generic)?

Target Sections

Section	Content
Critical Rules	Top 5-10 rules that cause most bugs if violated
Backend Rules	Naming, patterns, error handling, DI with DO/DON'T examples
Frontend Rules	Component, state, styling, cleanup with DO/DON'T examples
Architecture Rules	Layer boundaries, cross-service rules, shared code conventions
Anti-Patterns	Common mistakes found in codebase with real file:line, fixes
Decision Trees	For common decisions: which base class, where to put logic
Checklists	PR review checklists for backend, frontend, cross-cutting

Content Rules

• Every rule has a "DO" code example from the actual project
• Every rule has a "DON'T" counterexample (real file:line or clearly marked realistic)
• Use file:line references for all code examples
• Prioritize rules by impact (bugs prevented, not style preferences)

Phase 4: Write & Verify

1. Write updated doc with <!-- Last scanned: YYYY-MM-DD --> at top
2. Surgical update only — preserve sections unchanged, update only diverged
3. Verify (Glob check): ALL code example file paths exist
4. Verify (Grep check): Anti-pattern examples use real class/method names
5. Verify: Decision trees have concrete outcomes (not "it depends")
6. Report: sections updated, rules count, anti-patterns discovered

Final Step: Enhance Scanned Doc (MANDATORY)

MUST ATTENTION after the doc is written and verified, create a REQUIRED final todo task and run $prompt-enhance docs/project-reference/code-review-rules.md — why: this reference doc is injected into AI context; attention-anchoring (top/bottom Final Purpose, inline READ summaries, token density) directly raises downstream AI output quality. A scan is NOT complete until its doc is prompt-enhanced.

task tracking (required, last task): Run $prompt-enhance docs/project-reference/code-review-rules.md on the scanned doc

---

[IMPORTANT] Use task tracking to break ALL work into small tasks BEFORE starting — including tasks per file read. Prevents context loss from long files. Simple tasks: ask user whether to skip.

Prerequisites: MUST ATTENTION READ before executing:

Critical Thinking Mindset — Every claim needs traced proof, confidence >80% to act. Anti-hallucination: Never present guess as fact — cite sources, admit uncertainty, self-check output, cross-reference independently. Certainty without evidence = root of all hallucination.

Scan & Update Reference Doc — Surgical updates only, NEVER full rewrite.

1. Read existing doc first — understand structure and manual annotations
2. Detect mode: Placeholder (headings only) → Init. Has content → Sync.
3. Scan codebase (grep/glob) for current patterns
4. Diff findings vs doc — identify stale sections only
5. Update ONLY diverged sections. Preserve manual annotations.
6. Update metadata (date, version) in frontmatter/header
7. NEVER rewrite entire doc. NEVER remove sections without evidence obsolete.

Output Quality — Token efficiency without sacrificing quality.

1. No inventories/counts — stale instantly
2. No directory trees — use 1-line path conventions
3. No TOCs — AI reads linearly
4. One example per pattern — only if non-obvious
5. Lead with answer, not reasoning
6. Sacrifice grammar for concision in reports
7. Unresolved questions at end

AI Mistake Prevention — Failure modes to avoid on every task:

Check downstream references before deleting. Deleting components causes documentation and code staleness cascades. Map all referencing files before removal. Verify AI-generated content against actual code. AI hallucinates APIs, class names, and method signatures. Always grep to confirm existence before documenting or referencing. Trace full dependency chain after edits. Changing a definition misses downstream variables and consumers derived from it. Always trace the full chain. Trace ALL code paths when verifying correctness. Confirming code exists is not confirming it executes. Always trace early exits, error branches, and conditional skips — not just happy path. When debugging, ask "whose responsibility?" before fixing. Trace whether bug is in caller (wrong data) or callee (wrong handling). Fix at responsible layer — never patch symptom site. Assume existing values are intentional — ask WHY before changing. Before changing any constant, limit, flag, or pattern: read comments, check git blame, examine surrounding code. Verify ALL affected outputs, not just the first. Changes touching multiple stacks require verifying EVERY output. One green check is not all green checks. Holistic-first debugging — resist nearest-attention trap. When investigating any failure, list EVERY precondition first (config, env vars, DB names, endpoints, DI registrations, data preconditions), then verify each against evidence before forming any code-layer hypothesis. Surgical changes — apply the diff test. Bug fix: every changed line must trace directly to the bug. Don't restyle or improve adjacent code. Enhancement task: implement improvements AND announce them explicitly. Surface ambiguity before coding — don't pick silently. If request has multiple interpretations, present each with effort estimate and ask. Never assume all-records, file-based, or more complex path. Keep domain concepts out of generic/shared/infrastructure layers. A reusable layer (shared library, framework, infra module) must reference NO consumer-specific domain concept — tenant/customer/product IDs, business entities, feature rules. The leak compiles and runs, so it passes review silently while coupling the "reusable" layer to one consumer. Push domain fields/logic down into the consumer via subclass or composition.

IMPORTANT MUST ATTENTION read existing doc first, scan codebase, diff, surgical update only. Never rewrite entire doc.

IMPORTANT MUST ATTENTION output quality: no counts/trees/TOCs, 1 example per pattern, lead with answer.

MUST ATTENTION apply critical thinking — every claim needs traced proof, confidence >80% to act. Anti-hallucination: never present guess as fact.

MUST ATTENTION apply AI mistake prevention — holistic-first debugging, fix at responsible layer, surface ambiguity before coding, re-read files after compaction.

Closing Reminders

IMPORTANT MUST ATTENTION Final Step: run $prompt-enhance docs/project-reference/code-review-rules.md as the REQUIRED last todo task — never end the scan without enhancing the doc it just wrote. IMPORTANT MUST ATTENTION break work into small task tracking tasks BEFORE starting IMPORTANT MUST ATTENTION detect project scope FIRST in Phase 0 — agent routing depends on it IMPORTANT MUST ATTENTION cite file:line evidence for every claim (confidence >80% to act) IMPORTANT MUST ATTENTION derive rules from ACTUAL patterns — generic best practices are forbidden IMPORTANT MUST ATTENTION sub-agents write findings incrementally — NEVER batch at end IMPORTANT MUST ATTENTION when Round 1 finds issues, Round 2 fresh sub-agent after fixing catches what main agent missed. Clean Round 1 ENDS the scan.

Anti-Rationalization:

Evasion	Rebuttal
"Scope obvious, skip Phase 0 detection"	Phase 0 is BLOCKING — agent routing depends on detected scope
"Rules are standard, don't need examples"	Every rule MUST have file:line evidence from this project
"Anti-patterns are hypothetical"	Anti-Patterns section requires REAL file:line violations only
"Round 2 review not needed"	Main agent rationalizes own decisions. Fresh sub-agent is non-negotiable.
"Doc has content, skip re-read"	Show section list extracted from doc as proof of re-read

[TASK-PLANNING] Before acting, analyze task scope and break into small todo tasks and sub-tasks using task tracking.

Hookless Prompt Protocol Mirror (Auto-Synced)

Source: .claude/hooks/lib/prompt-injections.cjs + .claude/.ck.json

[WORKFLOW-EXECUTION-PROTOCOL] [BLOCKING] Workflow Execution Protocol — MANDATORY IMPORTANT MUST CRITICAL. Do not skip for any reason.

Generic portability boundary: Reusable skills and protocol text stay project-neutral; project-specific conventions are discovered from docs/project-config.json and docs/project-reference/. Apply shared AI-SDD from shared/sdd-artifact-contract.md. Read docs/project-config.json and docs/project-reference/docs-index-reference.md, then open the project reference docs named there. If either file or a required reference doc is missing, stop immediately and ask the user to run the project-config and scan-all skills. Any supported AI tool may execute when this shared context and local docs are available.

1. DETECT: Match prompt against workflow catalog
2. ANALYZE: Find best-match workflow AND evaluate if a custom step combination would fit better
3. ASK (REQUIRED FORMAT): Use a direct user question with this structure unless the user explicitly invoked a workflow/skill and the local protocol treats explicit invocation as confirmation:
   • Question: "Which workflow do you want to activate?"
   • Option 1: "Activate [BestMatch Workflow] (Recommended)"
   • Option 2: "Activate custom workflow: [step1 → step2 → ...]" (include one-line rationale)
4. ACTIVATE (if confirmed): Call $workflow-start <workflowId> for standard; sequence custom steps manually
5. CREATE TASKS: task tracking for ALL workflow steps
6. EXECUTE: Follow each step in sequence [CRITICAL-THINKING-MINDSET] Apply critical thinking, sequential thinking. Every claim needs traced proof, confidence >80% to act. Anti-hallucination principle: Never present guess as fact — cite sources for every claim, admit uncertainty freely, self-check output for errors, cross-reference independently, stay skeptical of own confidence — certainty without evidence root of all hallucination. AI Attention principle (Primacy-Recency): Put the 3 most critical rules at both top and bottom of long prompts/protocols so instruction adherence survives long context windows. Goal-driven execution: Define success criteria first, loop until verified, and stop only when observable checks pass. Tests verify intent: Tests must protect business rules/invariants and fail when the protected intent breaks, not only mirror current behavior.

[LESSON-LEARNED-REMINDER] [BLOCKING] Task Planning & Continuous Improvement — MANDATORY. Do not skip.

Break work into small tasks (task tracking) before starting. Add final task: "Analyze AI mistakes & lessons learned".

Extract lessons — ROOT CAUSE ONLY, not symptom fixes:

1. Name the FAILURE MODE (reasoning/assumption failure), not symptom — "assumed API existed without reading source" not "used wrong enum value".
2. Generality test: does this failure mode apply to ≥3 contexts/codebases? If not, abstract one level up.
3. Write as a universal rule — strip project-specific names/paths/classes. Useful on any codebase.
4. Consolidate: multiple mistakes sharing one failure mode → ONE lesson.
5. Recurrence gate: "Would this recur in future session WITHOUT this reminder?" — No → skip $learn.
6. Auto-fix gate: "Could $code-review/$code-simplifier/$security/$lint catch this?" — Yes → improve review skill instead.
7. BOTH gates pass → ask user to run $learn. [TASK-PLANNING] [MANDATORY] BEFORE executing any workflow or skill step, create/update task tracking for all planned steps, then keep it synchronized as each step starts/completes.