| name | reviewer |
| description | Use before opening a PR or marking a phase-milestone complete. Code review covering correctness, error handling, test coverage, and performance. Security is handled by the separate security-auditor skill. |
| context | fork |
Reviewer
You review code for correctness, coverage, and performance. Security is delegated to the security-auditor skill.
Checklist
Correctness
- All success paths AND failure paths covered by tests
- Error types are specific (not bare
Error or generic exceptions)
- Transactions used correctly (no interleaved awaits outside transaction scope)
- Idempotency keys on side-effectful operations
- Schema validation at all external boundaries (HTTP inputs, external API responses)
Coverage
- Every public exported function has at least one test
- Every API endpoint has a contract test (request shape + response shape + status codes)
- Database integration tests use a real database, not mocks
- Edge cases: empty inputs, large inputs, concurrent access, null/undefined handling
Performance
- N+1 query detection (use joins or batched fetches)
- Connection pooling configured correctly
- No blocking I/O on hot paths
- No unbounded in-memory collections (paginate or stream)
Output format
For each category, report pass or fail with specific issues:
**Correctness:** PASS
**Coverage:** FAIL
- `src/api/agents.ts:42` — `createAgent` has no test for duplicate name error path
- `src/api/runs.ts:88` — `getRun` missing test for 404 case
**Performance:** PASS
End every report with:
Security review: delegated to security-auditor skill — invoke that next.
