Conducts multi-axis code review. Use before merging any change. Use when reviewing code written by yourself, another agent, or a human. Use when you need to assess code quality across multiple dimensions before it enters the main branch.

Code Review and Quality Overview Multi dimensional code review with quality gates. Every change gets reviewed before merge — no exceptions. Review covers five axes: correctness, readability, architecture, security, and performance. The approval standard: Approve a change when it definitely improves overall code health, even if it isn't perfect. Perfect code doesn't exist — the goal is continuous improvement. Don't block a change because it isn't exactly how you would have written it. If it improves the codebase and follows the project's conventions, approve it. When to Use Before merging any PR or change After completing a feature implementation When another agent or model produced code you need to evaluate When refactoring existing code After any bug fix (review both the fix and the regression test) The Five Axis Review Every review evaluates code across these dimensions: 1. Correctness Does the code do what it claims to do? Does it match the spec or task requirements? Are edge cases handled (null, empty, boundary values)? Are error paths handled (not just the happy path)? Does it pass all tests? Are the tests actually testing the right things? Are there off by one errors, race conditions, or state inconsistencies? 2. Readability & Simplicity Can another engineer (or agent) understand this code without the author explaining it? Are names descriptive and consistent with project conventions? (No temp , data , result without context) Is the control flow straightforward (avoid nested ternaries, deep callbacks)? Is the code organized logically (related code grouped, clear module boundaries)? Are there any "clever" tricks that should be simplified? Could this be done in fewer lines? (1000 lines where 100 suffice is a failure) Are abstractions earning their complexity? (Don't generalize until the third use case) Would comments help clarify non obvious intent? (But don't comment obvious code.) Are there dead code artifacts: no op variables ( unused ), backwards compat shims, or // removed comments? Is a new conditional bolted onto an unrelated flow? That's a design smell, not a nit — push the logic into its own helper, state, or policy instead of tangling an existing path. Do repeated conditionals on the same shape appear? They signal a missing model or dispatcher. A "temporary" branch is usually permanent debt. 3. Architecture Does the change fit the system's design? Does it follow existing patterns or introduce a new one? If new, is it justified? Does it maintain clean module boundaries? Is there code duplication that should be shared? Are dependencies flowing in the right direction (no circular dependencies)? Is the abstraction level appropriate (not over engineered, not too coupled)? Does this refactor reduce complexity or just relocate it? Count the concepts a reader must hold to follow the change. If a "cleaner" version leaves that count unchanged, it isn't cleaner — prefer the restructuring that makes whole branches, modes, or layers disappear over one that re centralizes the same logic. Prefer deleting an abstraction to polishing it. Is feature specific logic leaking into a shared or general purpose module? Keep logic in its owning layer, reuse the existing canonical helper instead of a near duplicate, and don't normalize architectural drift. Are type boundaries explicit? Question gratuitous any / unknown /optional/casts and silent fallbacks that paper over an unclear invariant — making the boundary explicit often makes the surrounding control flow simpler. 4. Security For detailed security guidance, see security and hardening . Does the change introduce vulnerabilities? Is user input validated and sanitized? Are secrets kept out of code, logs, and version control? Is authentication/authorization checked where needed? Are SQL queries parameterized (no string concatenation)? Are outputs encoded to prevent XSS? Are dependencies from trusted sources with no known vulnerabilities? Is data from external sources (APIs, logs, user content, config files) treated as untrusted? Are external data flows validated at system boundaries before use in logic or rendering? 5. Performance For detailed profiling and optimization, see performance optimization . Does the change introduce performance problems? Any N+1 query patterns? Any unbounded loops or unconstrained data fetching? Any synchronous operations that should be async? Any unnecessary re renders in UI components? Any missing pagination on list endpoints? Any large objects created in hot paths? Structural Remedies When you flag a structural problem, propose the move — not just the problem. A review that only says "this is complex" leaves the author guessing. Reach for a named restructuring: Replace a chain of conditionals with a typed model or an explicit dispatcher. Collapse duplicate branches into a single clearer flow. Separate orchestration from business logic so each reads on its own. Move feature specific logic out of a shared module into the package that owns the concept. Reuse the canonical helper instead of a bespoke near duplicate. Make a type boundary explicit so downstream branching disappears. Delete a pass through wrapper that adds indirection without clarifying the API. Extract a helper, or split a large file into focused modules. Prefer the remedy that removes moving pieces over one that spreads the same complexity around. Change Sizing Small, focused changes are easier to review, faster to merge, and safer to deploy. Target these sizes: Watch file size, not just diff size. A small diff can still push a file past a healthy boundary — around 1000 total lines in a single file (distinct from the ~1000 changed lines threshold above) is a common inspection signal, not a hard cap. When a change materially grows an already large file, ask whether to extract helpers, subcomponents, or modules first , before piling more on. Decompose, then add. What counts as "one change": A single self contained modification that addresses one thing, includes related tests, and keeps the system functional after submission. One part of a feature — not the whole feature. Splitting strategies when a change is too large: Strategy How When Stack Submit a small change, start the next one based on it Sequential dependencies By file group Separate changes for groups needing different reviewers Cross cutting concerns Horizontal Create shared code/stubs first, then consumers Layered architecture Vertical Break into smaller full stack slices of the feature Feature work When large changes are acceptable: Complete file deletions and automated refactoring where the reviewer only needs to verify intent, not every line. Separate refactoring from feature work. A change that refactors existing code and adds new behavior is two changes — submit them separately. Small cleanups (variable renaming) can be included at reviewer discretion. Change Descriptions Every change needs a description that stands alone in version control history. First line: Short, imperative, standalone. "Delete the FizzBuzz RPC" not "Deleting the FizzBuzz RPC." Must be informative enough that someone searching history can understand the change without reading the diff. Body: What is changing and why. Include context, decisions, and reasoning not visible in the code itself. Link to bug numbers, benchmark results, or design docs where relevant. Acknowledge approach shortcomings when they exist. Anti patterns: "Fix bug," "Fix build," "Add patch," "Moving code from A to B," "Phase 1," "Add convenience functions." Review Process Step 1: Understand the Context Before looking at code, understand the intent: Step 2: Review the Tests First Tests reveal intent and coverage: Step 3: Review the Implementation Walk through the code with the five axes in mind: Step 4: Categorize Findings Label every comment with its severity so the author knows what's required vs optional: Prefix Meaning Author Action (no prefix) Required change Must address before merge Critical: Blocks merge Security vulnerability, data loss, broken functionality Nit: Minor, optional Author may ignore — formatting, style preferences Optional: / Consider: Suggestion Worth considering but not required FYI Informational only No action needed — context for future reference This prevents authors from treating all feedback as mandatory and wasting time on optional suggestions. Lead with what matters. Order findings by leverage: correctness and security first, then structural regressions and missed simplifications, then everything else. Don't bury a real issue under cosmetic nits — a few high conviction comments beat a long list. If you have one structural problem and ten nits, the structural problem is the review. Step 5: Verify the Verification Check the author's verification story: Multi Model Review Pattern Use different models for different review perspectives: This catches issues that a single model might miss — different models have different blind spots. Example prompt for a review agent: Dead Code Hygiene After any refactoring or implementation change, check for orphaned code: 1. Identify code that is now unreachable or unused 2. List it explicitly 3. Ask before deleting: "Should I remove these now unused elements: [list]?" Don't leave dead code lying around — it confuses future readers and agents. But don't silently delete things you're not sure about. When in doubt, ask. Review Speed Slow reviews block entire teams. The cost of context switching to review is less than the waiting cost imposed on others. Respond within one business day — this is the maximum, not the target Ideal cadence: Respond shortly after a review request arrives, unless deep in focused coding. A typical change should complete multiple review rounds in a single day Prioritize fast individual responses over quick final approval. Quick feedback reduces frustration even if multiple rounds are needed Large changes: Ask the author to split them rather than reviewing one massive changeset Handling Disagreements When resolving review disputes, apply this hierarchy: 1. Technical facts and data override opinions and preferences 2. Style guides are the absolute authority on style matters 3. Software design must be evaluated on engineering principles, not personal preference 4. Codebase consistency is acceptable if it doesn't degrade overall health Don't accept "I'll clean it up later." Experience shows deferred cleanup rarely happens. Require cleanup before submission unless it's a genuine emergency. If surrounding issues can't be addressed in this change, require filing a bug with self assignment. Honesty in Review When reviewing code — whether written by you, another agent, or a human: Don't rubber stamp. "LGTM" without evidence of review helps no one. Don't soften real issues. "This might be a minor concern" when it's a bug that will hit production is dishonest. Quantify problems when possible. "This N+1 query will add ~50ms per item in the list" is better than "this could be slow." Push back on approaches with clear problems. Sycophancy is a failure mode in reviews. If the implementation has issues, say so directly and propose alternatives. Accept override gracefully. If the author has full context and disagrees, defer to their judgment. Comment on code, not people — reframe personal critiques to focus on the code itself. Dependency Discipline Part of code review is dependency review: Before adding any dependency: 1. Does the existing stack solve this? (Often it does.) 2. How large is the dependen

code-review-and-quality