Code review and cleanup across reuse, quality, and efficiency dimensions. Launches three parallel review agents against the current diff, then aggregates findings and applies fixes.
Red-team the agent's own output against OWASP Top 10 for LLM Applications and Agentic AI. Self-inject, test boundaries, check exfiltration paths. If you can't attack your own output, someone else will.
Mandatory verification of every factual claim before emission. API contracts, dependency versions, file existence, behavior promises — claims about code are hypotheses until verified against the actual source. Based on Dhuliawala et al. (Meta FAIR, ACL 2024).
Disciplined 6-step diagnosis loop with strict evidence gates between stages. Reproduce → minimise → hypothesise → instrument → fix → regression-test. Cannot advance without the required artifact per step.
Split the workflow into Evaluator and Optimizer personas. Evaluator scores output 1–10 on correctness, completeness, safety, and simplicity. Optimizer rewrites to address critiques. Loop until score ≥9 or 3 iterations. Self-improvement without measurement is guessing.
Detect fail-open security patterns: debug mode in production, permissive CORS, disabled CSRF, default admin credentials, verbose error messages, unauthenticated health endpoints. Configuration is code — review it with the same rigor.
Encode Andrej Karpathy's four LLM coding failure modes as enforceable audit gates: (1) Hallucinated APIs, (2) Over-engineered solutions, (3) Missing error handling, (4) Unverified assumptions. Every code block must pass all four gates.
Submit proposed code to an external LLM for bias-breaking review. The external model critiques with fresh eyes, uninfluenced by the session history. Tool-agnostic: uses any available external LLM API.