code-review

name	code-review
description	Apply when reviewing a pull request in Hyperledger Cacti. Covers PR scope, Conventional Commits, TypeScript conventions, public API surface, testing, security (OWASP Top 10), AI slop detection, and CI status.

Review every PR against this checklist. Prioritize blocking issues over nits. Leave a comment only when you have a concrete, actionable suggestion. Do not approve a PR — human maintainer approval is required.

Checklist

#	Check	Goal	Reference
1	PR scope	One logical unit; no bundled unrelated concerns	PULL.md §1–2
2	Conventional Commits	Header ≤ 72 chars; correct type prefix; PR title matches linked issue	CONVENTIONS.md §8
3	TypeScript conventions	I prefix on interfaces; no any/console.log/eval; Prettier format	CONVENTIONS.md §5
4	Public API surface	New types in public-api.ts; no manual edits to generated/	CONVENTIONS.md §4
5	Package conventions	cacti- prefix; tsconfig.base.json extended; cactus-test-tooling devDep only	CONVENTIONS.md §3–4
6	Testing	Failing test for every behaviour change; port 0; no coverage bloat	CONVENTIONS.md §7, PULL.md §3
7	Security (OWASP Top 10)	No secrets/injection/permissive CORS/verbose errors; SHA-pinned Actions	SECURITY.md
8	AI slop	No restatement comments, single-caller abstractions, hallucinated APIs	AI_GUIDELINES.md
9	CI status	Fetch the PR's actual check-run results; report any failing checks	PR state

AI Slop Details (§8)

Flag the following as requiring resolution before merge:

• Restatement comments: // increment i by 1 above i++.
• Single-caller abstractions: helpers or classes created only to be called once.
• Hallucinated APIs: calls to methods/properties not in the installed library version.
• Coverage bloat: test blocks that pass even with a broken implementation.
• Generic identifiers: data, result, obj, handler where a domain name is possible.

CI Status (§9)

1. Use GitHub MCP tools to fetch the PR's actual check-run results.
2. List every failing or pending check by name.
3. Report each failure as Blocking with the check name and a link to the run log.

Output Format

• Severity: Blocking / Required / Nit
• File: path and line range (or CI for check-run failures)
• Issue: one-sentence description
• Suggestion: the exact change needed

Do not post a comment without a concrete suggestion.