review

name	review
description	Use after implementation to run independent code review - dispatches reviewer agents based on task level, ensures author-reviewer separation

Review

Dispatch reviewer agents (fresh context) against the current task's diff. Reviewers cannot read solutions/ — this is Invariant §1, not a suggestion.

Core principle: the author cannot review their own work. Reviewers must judge without historical-solution bias.

When to Use

• User runs /review after /work is complete
• Before /ship (a code review is required for L1+)

Permission

Directory	Access
decisions	R
progress	R
solutions	FORBIDDEN (§1)
reviews	W

Routing

• Behavior: src/commands/review.ts (runReview)
• Base reviewer: src/dispatcher/agents/reviewer-correctness.ts — runs at every level
• L2+ specialists: src/dispatcher/agents/reviewer-specialists.ts — reviewer.{security,migration,performance,infra} spawn in parallel when the diff matches their trigger keywords. Heuristic keyword matchers, not LLM-backed. Aggregate verdict = worst-of (pass < concern < fail)
• Manifest: 9 reviewers in contracts/sgc-capabilities.yaml. What each one actually is: correctness is the only LLM-backed reviewer and runs at every level; tests + maintainability are always-on at L2+; security/migration/performance/infra are diff-conditional at L2+ — all six are heuristic keyword matchers. adversarial and spec are status: slot-only: manifested but NEVER dispatched, so do not route work to them expecting a result.
• Scope pin: spawn.ts emits scope_tokens: + FORBIDDEN from: read:solutions in every reviewer prompt (holistically verified by tests/eval/reviewer-isolation.test.ts)
• Invariants: §1 reviewer no-solutions · §5 override reason ≥40 · §6 append-only per (task, stage, reviewer)

Execution

When this skill is invoked, dispatch to the sgc CLI:

bun src/sgc.ts review $ARGUMENTS

Re-running review for the same task throws AppendOnly — reviews are an audit trail, not a retry loop. To ship despite a fail verdict, supply --override "<≥40-char reason>" at sgc ship.

Delegation hint

For broader static analysis beyond sgc's reviewer cluster:

• gs:/review — pre-landing PR review with SQL safety, LLM trust boundary, and structural checks

L2+ specialist trigger table

At L2+ the dispatcher scans the diff and spawns matching specialists alongside reviewer.correctness and the always-on tests + maintainability pair. (Phase 2c / v1.27.0 lowered this gate from L3-only; this doc said L3 for four releases after that stopped being true.)

Specialist	Trigger keywords (loose match, identifier-friendly)	Severity on hit
reviewer.security	auth · jwt · token · session · crypto · password · secret · signature · encrypt/decrypt	medium
reviewer.migration	migration · ALTER/DROP/CREATE TABLE · ALTER/RENAME COLUMN · backfill	high
reviewer.performance	perf · cache · memoize · index · benchmark · n+1 · O(n) · p95/p99	medium
reviewer.infra	Dockerfile · FROM · kubectl · k8s · terraform · helm · fly.toml · vercel.json · render.yaml · github/workflows	high

Patterns are deliberately loose (no word boundaries) so camelCase / snake_case identifiers like signJwt or auth_token still match — false positives are acceptable for a keyword stub; precision is the LLM path's job.