code-review · diff
git:20261015.d2d76ef to git:20261016.0f9b29d
73 added, 47 removed. Audit C to A.
-
---
name: code-review
- description: Review code diffs for correctness, security vulnerabilities, regressions, error handling, and missing tests. Use when reviewing a proposed implementation or preparing changes for a commit.
+ description: >-
+ Review code diffs along two orthogonal axes: Standards (adherence to repo patterns and cleanliness) and Spec (adherence to task requirements). Use when reviewing a branch, PR, or proposed changes, or when invoked via /code-review.
---
- # Code Review Skill
+ Two-axis review of the diff between `HEAD` and a fixed point the user supplies:
- ## Review Process
+ - **Standards**: does the code conform to this repo's documented coding standards?
+ - **Spec**: does the code faithfully implement the originating issue / spec?
- 1. Establish the intended behavior from the task and relevant documentation.
- 2. Inspect the diff before reading unrelated files.
- 3. Trace modified code through its callers and dependencies.
- 4. Inspect tests covering the modified behavior.
- 5. Check failure paths and important boundary conditions.
- 6. Report only actionable findings supported by code evidence.
+ Both axes run as **parallel sub-agents** so they don't pollute each other's context, then this skill aggregates their findings.
- ## General Checks
+ The issue tracker should have been provided to you. If not, tell the user to run `/setup-matt-pocock-skills`.
- ### Correctness
- - Does the implementation meet the acceptance criteria?
- - Are conditions, loops, state transitions, and return values correct?
- - Are boundary cases handled?
+ ## Process
- ### Error Handling
- - Are failures handled consistently?
- - Can errors be silently swallowed?
- - Are resources cleaned up when operations fail?
+ ### 1. Pin the fixed point
- ### Security
- - Is untrusted input validated?
- - Are secrets or sensitive data exposed?
- - Are filesystem paths, subprocesses, URLs, and external inputs handled safely?
+ Whatever the user said is the fixed point (a commit SHA, branch name, tag, `main`, `HEAD~5`, etc.). If they didn't specify one, ask for it.
- ### Maintainability
- - Does the change follow established project patterns?
- - Is complexity unnecessarily increased?
- - Are duplicated abstractions or unnecessary dependencies introduced?
+ Capture the diff command once: `git diff <fixed-point>...HEAD` (three-dot, so the comparison is against the merge-base). Also note the list of commits via `git log <fixed-point>..HEAD --oneline`.
- ### Testing
- - Are important success and failure paths covered?
- - Are existing tests still applicable?
- - Do tests assert meaningful behavior instead of merely executing code?
+ Before going further, confirm the fixed point resolves (`git rev-parse <fixed-point>`) and the diff is non-empty. A bad ref or empty diff should fail here, not inside two parallel sub-agents.
- ## Finding Quality
+ ### 2. Identify the spec source
- A valid finding should explain:
- 1. What is wrong.
- 2. Where it occurs.
- 3. Under what conditions it causes a problem.
- 4. Why the problem matters.
- 5. How to fix it.
+ Look for the originating spec, in this order:
- Do not reportirst. Your skill currently lives at: personal preferences as bugs.
- Do not speculate beyond the available evidence.
- Do not claim a test passed unless it was executed and its result observed.
+ 1. Issue references in the commit messages (`#123`, `Closes #45`, GitLab `!67`, etc.), fetched via the workflow in the tracker doc.
+ 2. A path the user passed as an argument.
+ 3. A spec file under `docs/`, `specs/`, or `.scratch/` matching the branch name or feature.
+ 4. If nothing is found, ask the user where the spec is. If they say there isn't one, the **Spec** sub-agent will skip and report "no spec available".
- ## Context Efficiency
+ ### 3. Identify the standards sources
- - Inspect the diff first.
- - Read only relevant code and tests.
- - Do not dump full files or entire logs.
- - Avoid repeating findings.
- - Keep the final report concise and severity-ordered.
+ Search the repo for every file that documents how code should be written. When `CODING_STANDARDS.md` or `CONTRIBUTING.md` exists, it must be on the list.
+
+ On top of whatever the repo documents, the Standards axis always carries the **smell baseline** below: a fixed set of Fowler code smells (_Refactoring_, ch.3) that applies even when a repo documents nothing. Two rules bind it:
+
+ - **The repo overrides.** A documented repo standard always wins; where it endorses something the baseline would flag, suppress the smell.
+ - **Always a judgement call.** Each smell is a labelled heuristic ("possible Feature Envy"), never a hard violation. Like any standard here, skip anything tooling already enforces.
+
+ Each smell reads *what it is* → *how to fix*; match it against the diff:
+
+ - **Mysterious Name**: a function, variable, or type whose name doesn't reveal what it does or holds. → rename it; if no honest name comes, the design's murky.
+ - **Duplicated Code**: the same logic shape appears in more than one hunk or file in the change. → extract the shared shape, call it from both.
+ - **Feature Envy**: a method that reaches into another object's data more than its own. → move the method onto the data it envies.
+ - **Data Clumps**: the same few fields or params keep travelling together (a type wanting to be born). → bundle them into one type, pass that.
+ - **Primitive Obsession**: a primitive or string standing in for a domain concept that deserves its own type. → give the concept its own small type.
+ - **Repeated Switches**: the same `switch`/`if`-cascade on the same type recurs across the change. → replace with polymorphism, or one map both sites share.
+ - **Shotgun Surgery**: one logical change forces scattered edits across many files in the diff. → gather what changes together into one module.
+ - **Divergent Change**: one file or module is edited for several unrelated reasons. → split so each module changes for one reason.
+ - **Speculative Generality**: abstraction, parameters, or hooks added for needs the spec doesn't have. → delete it; inline back until a real need shows.
+ - **Message Chains**: long `a.b().c().d()` navigation the caller shouldn't depend on. → hide the walk behind one method on the first object.
+ - **Middle Man**: a class or function that mostly just delegates onward. → cut it, call the real target direct.
+ - **Refused Bequest**: a subclass or implementer that ignores or overrides most of what it inherits. → drop the inheritance, use composition.
+
+ ### 4. Spawn both sub-agents in parallel
+
+ Issue both sub-agent calls together, in the foreground, and aggregate the reports they return.
+
+ **Standards sub-agent prompt** should include:
+
+ - The full diff command and commit list.
+ - The list of standards-source files you found in step 3, **plus the smell baseline from step 3** pasted in full (the sub-agent has no other access to it).
+ - The brief: "Report, per file/hunk where relevant, (a) every place the diff violates a documented standard: cite the standard (file + the rule); and (b) any baseline smell you spot: name it and quote the hunk. Distinguish hard violations from judgement calls: documented-standard breaches can be hard, but baseline smells are always judgement calls, and a documented repo standard overrides the baseline. Skip anything tooling enforces. Under 400 words."
+
+ **Spec sub-agent prompt** should include:
+
+ - The diff command and commit list.
+ - The path or fetched contents of the spec.
+ - The brief: "Report: (a) requirements the spec asked for that are missing or partial; (b) behaviour in the diff that wasn't asked for (scope creep); (c) requirements that look implemented but where the implementation looks wrong. Quote the spec line for each finding. Under 400 words."
+
+ If the spec is missing, skip the Spec sub-agent and note this in the final report.
+
+ ### 5. Aggregate
+
+ Present the two reports under `## Standards` and `## Spec` headings, verbatim or lightly cleaned. Do **not** merge or rerank findings, because the two axes are deliberately separate (see _Why two axes_).
+
+ End with a one-line summary: total findings per axis, and the worst issue _within each axis_ (if any). Don't pick a single winner across axes: that's the reranking the separation exists to prevent.
+
+ ## Why two axes
+
+ A change can pass one axis and fail the other:
+
+ - Code that follows every standard but implements the wrong thing → **Standards pass, Spec fail.**
+ - Code that does exactly what the issue asked but breaks the project's conventions → **Spec pass, Standards fail.**
+
+ Reporting them separately stops one axis from masking the other.