ship-code

Perform a thorough, multi-persona pull-request review (senior engineer, senior security engineer, senior infra/SRE, conditional senior data engineer, plus test-coverage signal). Reads existing PR comment threads and suppresses findings that are already resolved, marked won't-fix, or addressed in a later commit. Computes a deterministic APPROVE / REQUEST_CHANGES / COMMENT decision and can submit the review via gh CLI (with confirmation gating in local mode and full automation in CI).

Apply DevOps and CI/CD review principles (CI pipelines, infrastructure-as-code, container images, secrets/config sourcing, observability, release management, schema migrations, health/readiness, SLO/performance, incident hygiene, and flow/batch signals) when writing or reviewing pipeline YAML, IaC, Dockerfiles, k8s manifests, deploy scripts, and the application code that integrates with them. Invoke explicitly for DevOps/CI/CD reviews, or as the delegation target from the ship-reviewed-prs IN (Senior Infra / SRE / DevOps) persona. Do not invoke for pure styling, application-only logic, one-off prototypes, or test-design depth (use ship-clean-code, ship-secure-code, or ship-tested-code respectively).

Apply application-security principles (auth, input validation, injection, XSS/output encoding, CSRF/origin, crypto, secrets, supply chain, PII/logging, resource exhaustion, path traversal, deserialization/SSRF) when writing or reviewing security-sensitive Python, TypeScript/JavaScript, or Java code. Invoke explicitly for security reviews or as the delegation target from ship-reviewed-prs SC persona. Do not invoke for pure styling, shell scripts, one-off prototypes, or non-security code review (use ship-clean-code).

Apply clean code principles (naming, functions, classes, error handling, testing, formatting) when writing or reviewing production-quality Python, TypeScript/JavaScript, or Java code. Invoke explicitly for PR reviews or code quality assessments. Do not invoke for shell scripts, SQL queries, config files, quick prototypes, or single-expression snippets.

Apply systematic debugging practices (reproduction, hypothesis-driven investigation, bisection, root-cause analysis, regression-test design) when investigating, isolating, or fixing bugs in Python, TypeScript/JavaScript, or Java code. Invoke explicitly for bug investigations, incident postmortems, or debugging reviews. Do not invoke for greenfield feature work or pure refactoring with no failure signal.

Apply testing best practices (test design, TDD, test strategy, mocking, integration testing, CI/CD testing) when writing or reviewing tests for Python, TypeScript/JavaScript, or Java code. Invoke explicitly for test reviews or test strategy assessments. Do not invoke for shell scripts, config files, or one-off scripts.