code-ai-installer 3.0.0 → 4.0.1-a

package/domains/development/locales/en/.agents/skills/code-review-checklist/SKILL.md

@@ -1,133 +1,286 @@
 ---
 name: code-review-checklist
-description: Universal review checklist — code quality, readability, testability, security, contracts, Definition of Done.
+description: "Universal review checklist — code quality, readability, testability, security, contracts, Definition of Done."
+type: reference
+domain: development
+owners:
+  - reviewer
+gates:
+  - REV
+tech: []
+topic:
+  - review
+  - security
+triggers:
+  - review checklist
+  - code review
+  - code quality
+  - PR review
+  - Definition of Done
+  - code testability
+related:
+  - api-contract-compliance-review
+  - api-contracts
+  - architecture-compliance-review
+  - architecture-doc
+  - review-reference-snippets
+  - security-review
+  - tests-quality-review
+budget_lines: 400
+schema_version: 1
 ---
 
-# Skill: Universal Code Review Checklist
 
-Checklist for the Reviewer Agent or self-review before handoff.
+# Skill: Code Review Checklist
+
+Systematic review of PR/code against project standards.
 
 **Sections:**
-1. [When to use](#1-when-to-use)
-2. [Checklist](#2-checklist)
-3. [Reviewer's Output Format](#3-reviewer-output)
-4. [Anti-patterns](#4-anti-patterns)
+1. [When to use](#1-when)
+2. [Workflow](#2-workflow)
+3. [Checklist](#3-checklist)
+4. [Automated Checks](#4-automated)
+5. [Severity](#5-severity)
+6. [Output Template](#6-output)
+7. [Anti-patterns](#7-anti-patterns)
 
 ---
 
-## 1. When to use
+## 1. When to use <a id="1-when"></a>
+
+Use this checklist **after** the Senior Full Stack developer has finished coding, but **before** passing the task to the Tester or closing it. The Reviewer Agent uses this checklist as the primary framework.
 
-Use this checklist *after* the Senior Full Stack developer has finished coding, but *before* passing the task to QA (Tester) or closing it.
+---
 
-The Reviewer Agent uses this checklist as the primary framework.
+## 2. Workflow <a id="2-workflow"></a>
+
+```
+1. Read PR description / task
+   └── What should change? What are the acceptance criteria?
+
+2. Automated checks (section 4)
+   └── grep patterns, lint, tests, audit
+
+3. Walk through the checklist (section 3)
+   └── For each item: PASS / FINDING (P0/P1/P2)
+
+4. Produce review report (section 6)
+   └── Summary + findings + verdict
+```
 
 ---
 
-## 2. Checklist
+## 3. Checklist <a id="3-checklist"></a>
 
-### 2.1 Definition of Done (DoD)
+### 3.1 Definition of Done (DoD)
 
 | # | Check | Severity | Status |
 |---|-------|----------|--------|
-| REV-01 | PRD requirements are met (no missing scope) | 🔴 P0 | ☐ |
-| REV-02 | Code runs without crashing (no obvious syntax errors) | 🔴 P0 | ☐ |
+| REV-01 | PRD requirements met (no missing scope, acceptance criteria met) | 🔴 P0 | ☐ |
+| REV-02 | Code runs without crashing (no syntax errors) | 🔴 P0 | ☐ |
 | REV-03 | UX Spec visually matched (no missing UI elements) | 🔴 P0 | ☐ |
 | REV-04 | No `console.log` or debug code left behind | 🟠 P1 | ☐ |
 
-### 2.2 Architecture & Contracts
+### 3.2 Code Quality
 
 | # | Check | Severity | Status |
 |---|-------|----------|--------|
-| REV-05 | Code follows `$architecture-doc` layers | 🔴 P0 | ☐ |
-| REV-06 | API implementation matches `$api-contracts` exactly | 🔴 P0 | ☐ |
-| REV-07 | New data model (if any) is documented | 🟠 P1 | ☐ |
-| REV-08 | ADR created if a significant architectural choice was made | 🟠 P1 | ☐ |
+| REV-05 | Clear names (functions = verb+object `createCoupon`; vars = noun `activeCount`; no `data`, `temp`, `x`) | 🟠 P1 | ☐ |
+| REV-06 | Small functions (single responsibility, < 40 lines; if > 60 → split) | 🟠 P1 | ☐ |
+| REV-07 | No duplication (DRY without fanaticism; 3+ repetitions = extract to helper) | 🟠 P1 | ☐ |
+| REV-08 | No magic (implicit side effects, hidden globals, undocumented hooks with business logic) | 🟠 P1 | ☐ |
+| REV-09 | JSDoc on functions (`@param`, `@returns`, description; mandatory for public API) | 🔴 P0 | ☐ |
+| REV-10 | No `any` / `@ts-ignore` (each use = conscious exception with comment) | 🟠 P1 | ☐ |
+| REV-11 | No magic numbers/hardcoded strings (extract to constant) | 🟠 P1 | ☐ |
+| REV-12 | React: no useless re-renders, correct memoization (`useMemo`/`useCallback`) | 🟠 P1 | ☐ |
+| REV-13 | ESLint / Type checking passes (no red squiggles) | 🔴 P0 | ☐ |
+| REV-14 | Go: correct error handling (`if err != nil`), no hidden panics | 🔴 P0 | ☐ |
+
+### 3.3 Architecture
 
-### 2.3 Code Quality & Best Practices
+| # | Check | Severity | Status |
+|---|-------|----------|--------|
+| REV-15 | Follows `$architecture-doc` / ADR (new module → verify it is in the diagram) | 🔴 P0 | ☐ |
+| REV-16 | No tight coupling (module A does not import internals of B; only public API) | 🟠 P1 | ☐ |
+| REV-17 | No God Object (file < 500 lines, class < 10 public methods) | 🟠 P1 | ☐ |
+| REV-18 | Layer boundaries (Router → Controller → Service → Repository; no DB calls in router) | 🔴 P0 | ☐ |
+| REV-19 | New patterns/libraries/strategies → ADR required | 🟠 P1 | ☐ |
+| REV-20 | New data model documented (if any) | 🟠 P1 | ☐ |
+
+### 3.4 API & Data
 
 | # | Check | Severity | Status |
 |---|-------|----------|--------|
-| REV-09 | ESLint / Type checking passes (no red squiggles) | 🔴 P0 | ☐ |
-| REV-10 | Meaningful variable/function naming (no `data1`, `temp`) | 🟠 P1 | ☐ |
-| REV-11 | JSDoc present for all functions | 🔴 P0 | ☐ |
-| REV-12 | Functions are short and focused (< 40 lines ideally) | 🟠 P1 | ☐ |
-| REV-13 | No magic numbers or hardcoded strings | 🟠 P1 | ☐ |
-| REV-14 | React: No useless re-renders, correct memoization | 🟠 P1 | ☐ |
-| REV-15 | Go: correct error handling (`if err != nil`), no hidden panics | 🔴 P0 | ☐ |
+| REV-21 | API contracts match `$api-contracts` spec (new endpoints documented) | 🔴 P0 | ☐ |
+| REV-22 | Validation at boundary (Zod schema in middleware, before business logic) | 🔴 P0 | ☐ |
+| REV-23 | Unified error format `{ error: { code, message, details } }` (no stack/DB errors in response) | 🔴 P0 | ☐ |
+| REV-24 | Status codes (201 create, 204 delete, 409 duplicate; not all 200) | 🟠 P1 | ☐ |
+| REV-25 | Data model consistent (schema changes + migration; indexes for new queries) | 🟠 P1 | ☐ |
 
-### 2.4 Error Handling & Logging
+### 3.5 Error Handling & Logging
 
 | # | Check | Severity | Status |
 |---|-------|----------|--------|
-| REV-16 | Errors are caught (try/catch or `.catch()`) and handled | 🔴 P0 | ☐ |
-| REV-17 | Error format follows contract (`{ error: { code, message } }`) | 🔴 P0 | ☐ |
-| REV-18 | Structured logging used for significant events (not just `console.error`) | 🟠 P1 | ☐ |
+| REV-26 | Errors caught (try/catch or `.catch()`) and handled | 🔴 P0 | ☐ |
+| REV-27 | Structured logging (pino with level, message, context) — not raw `console.error` | 🟠 P1 | ☐ |
+| REV-28 | requestId correlation in all logs of the request chain | 🟠 P1 | ☐ |
+| REV-29 | No PII in logs (no email, password, token, creditCard) | 🔴 P0 | ☐ |
 
-### 2.5 Security Basics
+### 3.6 Tests
 
 | # | Check | Severity | Status |
 |---|-------|----------|--------|
-| REV-19 | Inputs are validated against boundary schemas (e.g., Zod) | 🔴 P0 | ☐ |
-| REV-20 | Protected routes check Auth properly | 🔴 P0 | ☐ |
-| REV-21 | No secrets (API keys, passwords) in code or frontend bundle | 🔴 P0 | ☐ |
-| REV-22 | Safe HTML rendering (dangerouslySetInnerHTML only if sanitized) | 🔴 P0 | ☐ |
+| REV-30 | Tests added/updated (new code = new tests; changed code = updated tests) | 🔴 P0 | ☐ |
+| REV-31 | Tests passing (`npm test` green) | 🔴 P0 | ☐ |
+| REV-32 | Happy path covered (main scenario works) | 🔴 P0 | ☐ |
+| REV-33 | Edge cases (empty input, max values, boundary conditions) | 🟠 P1 | ☐ |
+| REV-34 | Error paths (invalid → 400, not found → 404, auth → 401) | 🟠 P1 | ☐ |
+| REV-35 | No flaky tests (no `setTimeout`, no order dependency) | 🟠 P1 | ☐ |
+| REV-36 | AAA pattern (Arrange → Act → Assert; one assert per concept) | 🟠 P1 | ☐ |
+| REV-37 | No test magic (no hardcoded IDs, no shared mutable state) | 🟠 P1 | ☐ |
 
-### 2.6 Testing
+### 3.7 Security
 
 | # | Check | Severity | Status |
 |---|-------|----------|--------|
-| REV-23 | Unit tests written or updated for new logic | 🔴 P0 | ☐ |
-| REV-24 | Tests pass successfully | 🔴 P0 | ☐ |
-| REV-25 | Edge cases and error paths tested | 🟠 P1 | ☐ |
+| REV-38 | AuthZ on server (`req.appInstanceId` verified before data access; no IDOR) | 🔴 P0 | ☐ |
+| REV-39 | No secrets in code (no hardcoded passwords, API keys, tokens; no frontend bundle exposure) | 🔴 P0 | ☐ |
+| REV-40 | Safe error messages (no stack trace, no DB error, no PII in response) | 🔴 P0 | ☐ |
+| REV-41 | Input sanitization (no `eval()`, no `dangerouslySetInnerHTML` without sanitize) | 🔴 P0 | ☐ |
+| REV-42 | Protected routes check Auth properly | 🔴 P0 | ☐ |
+| REV-43 | Dependency audit (no known high/critical vulnerabilities) | 🔴 P0 | ☐ |
+
+### 3.8 Observability & Ops
+
+| # | Check | Severity | Status |
+|---|-------|----------|--------|
+| REV-44 | Health endpoints (`/health/live` and `/health/ready` working) | 🟠 P1 | ☐ |
+| REV-45 | Build/run instructions (README or comments explain how to run changed code) | 🟡 P2 | ☐ |
 
 ---
 
-## 3. Reviewer's Output Format
+## 4. Automated Checks <a id="4-automated"></a>
 
-If passing the review:
+### Grep patterns (run during review)
 
-```markdown
-# Code Review: Approved
+```bash
+# Security
+grep_search: Query="console.log"               → P1: replace with pino
+grep_search: Query="eval("                     → P0: code injection risk
+grep_search: Query="dangerouslySetInnerHTML"   → P0: XSS risk
+grep_search: Query="password.*=.*\""           → P0: hardcoded secret
+grep_search: Query="@ts-ignore"                → P1: type safety bypass
+grep_search: Query="any" Includes=["*.ts"]     → P1: weak typing
+grep_search: Query="eslint-disable"            → P1: rule bypass
+grep_search: Query="TODO|FIXME|HACK|XXX"       → P2: track tech debt
 
-All checks passed.
-- **DoD:** Met
-- **Code Quality:** Good, proper TDD cycle used.
-- **Contracts:** API matches spec perfectly.
+# Architecture
+grep_search: Query="mongoose" Includes=["*/routes/*","*/controllers/*"]  → P1: DB in wrong layer
+grep_search: Query="req.body" Includes=["*/services/*"]                  → P1: HTTP in service layer
 
-**Next Action:** Handoff to Tester Agent.
+# Tests
+find_by_name: Pattern="*.test.*" → count test files vs source files
+find_by_name: Pattern="*.spec.*" → same
 ```
 
-If requesting changes:
+---
+
+## 5. Severity <a id="5-severity"></a>
+
+| Level | Description | Action |
+|-------|-----------|--------|
+| 🔴 **P0** | Security vulnerability, data loss, broken core flow | Block merge. Fix immediately |
+| 🟠 **P1** | Tech debt, missing validation, no tests, architecture violation | Request fix before merge |
+| 🟡 **P2** | Style, naming, minor optimization, nice-to-have | Optional. Note for future |
+
+---
+
+## 6. Output Template <a id="6-output"></a>
+
+### Full review report
+
+```markdown
+# Code Review Report
+
+**PR/Task:** <title>
+**Reviewer:** Reviewer Agent
+**Date:** YYYY-MM-DD
+**Files reviewed:** <count>
+
+## Summary
+<1-2 sentences: what this PR does, overall quality assessment>
+
+## Automated Checks
+| Check | Result |
+|-------|--------|
+| Lint (biome) | ✅ Pass |
+| Tests (vitest) | ✅ Pass (42/42) |
+| npm audit | ⚠️ 1 moderate |
+| Secret scan | ✅ Clean |
+
+## Findings
+
+| # | Severity | Category | File | Finding | Recommendation |
+|---|----------|----------|------|---------|----------------|
+| 1 | 🔴 P0 | Security | `api/routes/settings.js:32` | No authZ check — any user can update any settings | Add appInstanceId ownership check |
+| 2 | 🟠 P1 | Tests | `api/services/coupon.test.js` | No error path test for duplicate coupon | Add test: POST with duplicate code → 409 |
+| 3 | 🟡 P2 | Quality | `dashboard/components/Timer.jsx:15` | Magic number `60` | Extract to constant `SECONDS_PER_MINUTE` |
+
+## Checklist Summary
+
+| Section | Pass | Findings | Total |
+|---------|:----:|:--------:|:-----:|
+| DoD | 4 | 0 | 4 |
+| Code Quality | 9 | 1 | 10 |
+| Architecture | 6 | 0 | 6 |
+| API & Data | 4 | 1 | 5 |
+| Errors & Logging | 4 | 0 | 4 |
+| Tests | 6 | 2 | 8 |
+| Security | 5 | 1 | 6 |
+| Observability | 2 | 0 | 2 |
+
+## Verdict
+- ✅ **APPROVED** — no P0/P1, minor P2 notes.
+- ⚠️ **CHANGES REQUESTED** — P0/P1 must be fixed before merge
+- ❌ **REJECTED** — fundamental issues, needs redesign
+```
+
+### Compact templates (alternative)
+
+```markdown
+# Code Review: Approved
+All checks passed. **DoD:** Met. **Code Quality:** Good. **Contracts:** API matches spec.
+**Next:** Handoff to Tester.
+```
 
 ```markdown
 # Code Review: Changes Requested
 
 ## P0 Blockers (Must Fix)
-- **REV-11 (JSDoc):** `calculateTotal()` in `src/utils/cart.js:45` is missing JSDoc.
-- **REV-19 (Security):** `POST /checkout` is missing Zod body validation.
+- **REV-09 (JSDoc):** `calculateTotal()` in `src/utils/cart.js:45` is missing JSDoc.
+- **REV-22 (Security):** `POST /checkout` is missing Zod body validation.
 
 ## P1 Recommendations (Should Fix)
-- **REV-13 (Code Quality):** Hardcoded tax rate `0.2` in `cart.js:52`. Extract to constant.
-- **REV-14 (React):** Define `fetchData` outside `useEffect` or wrap in `useCallback` in `Cart.tsx:20`.
+- **REV-11 (Code Quality):** Hardcoded tax rate `0.2` in `cart.js:52`. Extract to constant.
 
-**Next Action:** Return to Senior Full Stack to fix P0/P1 issues.
+**Next:** Return to Senior Full Stack to fix P0/P1.
 ```
-
----
-
-## 4. Anti-patterns
+## 7. Anti-patterns <a id="7-anti-patterns"></a>
 
 | ❌ Anti-pattern | ✅ Solution |
 |----------------|-----------|
-| **Rubber stamping** | Actually run `npm run test` or check the code logic. Don't just say "LGTM". |
-| **Nitpicking without P0/P1 labels** | Clearly separate blockers (P0) from stylistic suggestions (P2). |
-| **Ignoring the contract** | The code might be beautiful but if it returns HTTP 200 instead of 201 as per `$api-contracts`, it's a bug. |
-| **Skipping security checks** | Always check for input validation and auth boundaries. |
+| **Rubber stamping** | Actually run `npm run test` or check the code logic. Don't just say "LGTM" |
+| **Nitpicking without P0/P1 labels** | Clearly separate blockers (P0) from stylistic suggestions (P2) |
+| **Ignoring the contract** | The code might be beautiful but if it returns HTTP 200 instead of 201 per `$api-contracts`, it is a bug |
+| **Skipping security checks** | Always check input validation and auth boundaries |
 
 ---
 
 ## See also
-- `$api-contract-compliance-review` — Deeper dive into API contracts.
-- `$architecture-compliance-review` — Deeper dive into layer boundaries.
-- `$security-review` — Deeper dive into AppSec.
-- `$tests-quality-review` — Deeper dive into test quality.
+- `$api-contract-compliance-review` — deeper dive into API contracts
+- `$api-contracts` — API specifications
+- `$architecture-compliance-review` — deeper dive into layer boundaries
+- `$architecture-doc` — architectural reference
+- `$review-reference-snippets` — DO/DON'T code examples
+- `$security-review` — deep AppSec review
+- `$tests-quality-review` — deep test quality review

package/domains/development/locales/en/.agents/skills/code-review-checklist/agents/kimi.yaml

@@ -1,15 +1,15 @@
-name: "code-review-checklist"
-display_name: "Universal Code Review Checklist"
-description: "Universal review checklist — code quality, readability, testability, security, contracts, Definition of Done."
-default_prompt: "Use $code-review-checklist when the task matches the \"Universal Code Review Checklist\" skill."
-triggers:
-  - "code-review-checklist"
-  - "code review checklist"
-  - "Universal Code Review Checklist"
-  - "Universal review checklist — code quality, readability, testability, security, contracts, Definition of Done"
-capabilities:
-  - "code"
-  - "review"
-  - "checklist"
-tools: []
-implicit_invocation: true
+name: "code-review-checklist"
+display_name: "Universal Code Review Checklist"
+description: "Universal review checklist — code quality, readability, testability, security, contracts, Definition of Done."
+default_prompt: "Use $code-review-checklist when the task matches the \"Universal Code Review Checklist\" skill."
+triggers:
+  - "code-review-checklist"
+  - "code review checklist"
+  - "Universal Code Review Checklist"
+  - "Universal review checklist — code quality, readability, testability, security, contracts, Definition of Done"
+capabilities:
+  - "code"
+  - "review"
+  - "checklist"
+tools: []
+implicit_invocation: true