joomla6-review

name	joomla6-review
description	Run a read-only, multi-agent Joomla 6 review of changed or requested files and save an actionable report under docs/review-logs. Use when the user asks for a code review, security review, Joomla standards review, PHP or JavaScript quality review, performance review, comment review, or lint review.

Joomla 6 Review

Review code without editing it. The review is a hard read-only gate: do not apply fixes in the same task.

Required setup

Load the relevant Joomla 6 skills before reviewing:

• joomla6-general-concepts
• joomla6-extensions
• joomla6-security
• joomla6-code-reviewer

Use the specialized agents registered in .codex/config.toml. Run independent applicable reviewers concurrently when agent delegation is available.

Inputs

Infer these values from the user's request:

• scope: full, security, joomla, js, comments, performance, or linter; default full.
• files: an optional file or directory restriction; otherwise use files changed from HEAD.
• threshold: optional minimum severity; default low.

If the directory is not a Git worktree and the user did not specify files, review the authored extension files in the current workspace and state that fallback in the report.

File selection

Exclude dependencies and generated or third-party content:

• libraries/, vendor/, node_modules/, dist/, and build/
• minified CSS and JavaScript
• lock files
• bundled third-party assets under media/
• Joomla core extensions and templates

Never propose a change to a Joomla core file. Recommend an extension-side plugin, subscriber, service override, or template override instead.

Agent routing

Use these registered Codex agents:

Scope	Agents
full	all seven specialist reviewers below
security	joomla6_security_reviewer
joomla	joomla6_standards, joomla6_php_quality
js	joomla6_js_quality
comments	joomla6_comment_reviewer
performance	joomla6_performance
linter	joomla6_linter_runner

The seven specialists are security, standards, PHP quality, JavaScript quality, comments, performance, and linter. Give every agent the exact file list and ask for findings with severity, confidence, file, line, impact, and a concrete Joomla 6-safe fix.

Aggregation rules

1. Deduplicate identical file-and-line findings, preserving the strongest evidence.
2. Sort CRITICAL, HIGH, MEDIUM, then LOW.
3. Drop findings below the requested threshold.
4. Reject fixes using legacy J* APIs, FOF, jQuery, Factory::getDbo(), Factory::getUser(), or Joomla\CMS\Filesystem\*.
5. Do not add types to inherited untyped properties without verifying parent compatibility.
6. Do not suggest resolving non-component plugin services through CMSApplicationInterface unless registration is verified.
7. Mark architecture-bypassing fixes such as raw SQL replacing an existing model as REQUIRES APPROVAL.

Output

Always save the report as:

docs/review-logs/review-{scope}-{YYYY-MM-DD}-{short-description}.md

Include:

• scope, reviewed-file counts, agent count, and verdict
• severity summary table
• findings with file, line, agent, evidence, impact, and fix
• a self-contained implementation task list grouped by severity

Verdicts:

• Needs Work: any critical finding
• Needs Attention: any high finding and no critical finding
• Ready to Merge: no critical or high findings

Tell the user the verdict, severity counts, and report path. Ask for a separate explicit instruction before applying fixes.