1 added, 1 removed. Audit A to A.
---
name: code-review-plus
description: >-
Multi-perspective code review with parallel subagents, adaptive pipeline tiers, optional stack shapes (including llm; shapes on normal when the stack is a single obvious tag), optional P0 verifier, and a prioritized P0–P3 report. Branches: review (default), fix / apply / implement (apply findings without regressions). Invoke by name only (e.g. /code-review-plus, /code-review-plus fix).
disable-model-invocation: true
metadata:
- version: 0.4.0
+ version: 0.4.1
author: "Diego Oliveira"
tags:
- code
- code review
- security review
- pr
- review
---
# Code Review Plus
**Branches:** review (default) → parallel pipelines → double verify → synthesize → report. Fix branch applies findings with a **regression gate**.
**Invariants:** Each pipeline runs as a separate hunter (subagent). Every finding is reproducible from the code. Keep only `proven` or `likely` issues with a pointable line today. Prefer a minimal local fix over a broad refactor.
**Reference budget:** The orchestrator selects paths; never preload `references/`. Each hunter gets exactly **1** perspective plus **0 or 1** shape (`≤2` paths). Orchestrator-only refs (`dependency-review`, `remedies`, `examples`) are not hunter paths.
## Commands
| Invocation | Branch | Behavior |
| ----------------------------- | ---------- | --------------------------------- |
| `/code-review-plus` | **review** | Phases 1→4 only |
| `/code-review-plus fix` | **fix** | `./references/phases/fix.md` only |
| `/code-review-plus apply` | **fix** | Alias of `fix` |
| `/code-review-plus implement` | **fix** | Alias of `fix` |
`fix`, `apply`, and `implement` are synonyms. Without a subcommand, never open `fix.md`. The fix branch never re-dispatches review pipelines.
## Definition of Done
### Branch review
| Phase | Done when | READ |
| ------------ | ------------------------------------------------------------------------------------------- | ----------------------------------- |
| 1 Scope | Scope + intent + tier + stack tags + context summary ready | `./references/phases/scope.md` |
| 2 Dispatch | Tier pipelines returned candidates; shapes recorded when attached | `./references/phases/dispatch.md` |
| 2.5 Verify | Every candidate has kept/dropped/downgraded + note; optional P0 verifier applied or skipped | `./references/phases/verify.md` |
| 3 Synthesize | Surviving findings have required fields + severity | `./references/phases/synthesize.md` |
| 4 Report | Skeleton fill of `report.md` (Findings Overview pipe table + verdict + drop counts) | `./references/templates/report.md` |
Do not open a later phase file until the current phase completion criterion is met.
### Branch fix (`fix` \| `apply` \| `implement`)
| Phase | Done when | READ |
| ----- | ----------------------------------------------------------- | ---------------------------- |
| Fix | Findings applied or deferred without new demonstrable P0/P1 | `./references/phases/fix.md` |
Prerequisite: a prior report in this conversation (or an explicit finding list). If missing, ask; do not invent findings.
## Branch review — phases
### Phase 1 — Scope
**READ:** `./references/phases/scope.md`
**Completion criterion:** Scope answers written; review source, tier, and stack tags identified; context summary ready.
### Phase 2 — Dispatch
**READ:** `./references/phases/dispatch.md`
**Completion criterion:** Every dispatched pipeline returned; each candidate has `file:line`, `exploit_or_break_path`, and `evidence_level`.
### Phase 2.5 — Double verify
**READ:** `./references/phases/verify.md`
**Completion criterion:** Every candidate has status + `verification_note`; drop/downgrade counts recorded; optional P0 verifier ran or skipped per its triggers.
### Phase 3 — Synthesize
**READ:** `./references/phases/synthesize.md`
**Completion criterion:** Every surviving finding has all required fields; P2/P3 capped per calibration.
### Phase 4 — Report
**READ:** `./references/templates/report.md`
**Completion criterion:** User-facing reply is a skeleton fill of that template — English heading strings, Findings Overview as a Markdown pipe table (`ID | Severity | Category | Perspective | File | Issue`), verdict, pipelines line (shapes when used), verified-vs-dropped counts, and explicit unverified claims. Zero kept findings is valid (state that nothing was found; table header only).
## Branch fix
**READ:** `./references/phases/fix.md`
**Completion criterion:** Every targeted finding is closed (gate passed) or explicitly deferred. No new demonstrable P0/P1 left by the fixes.
## Rules
- Orchestrator opens phase/template files only when that phase or branch starts
- Hunters open only their assigned perspective and optional shape (`≤2` paths)
- File:line required; concrete break/exploit path for every P0/P1
- Clarity findings measure comprehension speed; a valid fix preserves behavior and error paths
- Preference without a codebase inconsistency → skip (not a finding)
- Report secrets as `file:line` + secret type only; redact values in the report and in fixes
- When verification yields zero kept findings, say so and Approve — Findings Overview keeps header + separator only; skip empty severity sections; do not fabricate issues to fill the report
- Phase 4 deliverable is a skeleton fill of `report.md`: keep its English headings; Findings Overview is always the six-column pipe table (detail sections expand rows, they do not replace the table); translate prose inside sections when the user language differs
- Ask before deleting dead code; never recommend blind removal
- State unverified claims explicitly
- Verdict needs evidence; do not soften a verified bug
- Optional P0 verifier: at most one subagent after Pass B; never reopens the five pipelines; does not assign final severity
## Relation to `deep-security-review`
Both skills are user-invoked. Use this skill for multi-perspective PR/diff review (optional stack shapes, including `llm`). Use `/deep-security-review` when security is the primary goal. Do not run both Security perspectives on the same scope in parallel; that skill replaces this skill's shallow security pass. Tell the user to invoke it; do not auto-start it.