liteagents 2.8.3 → 2.10.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (113) hide show
  1. package/CHANGELOG.md +51 -0
  2. package/README.md +25 -31
  3. package/installer/cli.js +6 -2
  4. package/package.json +3 -3
  5. package/packages/ampcode/AGENT.md +9 -15
  6. package/packages/ampcode/agents/code-developer.md +11 -12
  7. package/packages/ampcode/agents/quality-assurance.md +1 -1
  8. package/packages/{droid/commands/systematic-debugging.md → ampcode/commands/debug-method.md} +9 -9
  9. package/packages/ampcode/commands/diff-review.md +78 -0
  10. package/packages/ampcode/commands/friction/friction.js +348 -122
  11. package/packages/ampcode/commands/optimize.md +45 -4
  12. package/packages/ampcode/commands/refactor.md +33 -1
  13. package/packages/ampcode/commands/remember.md +107 -46
  14. package/packages/ampcode/commands/security.md +28 -1
  15. package/packages/ampcode/commands/stash.md +7 -0
  16. package/packages/{droid/commands/test-driven-development.md → ampcode/commands/tdd-flow.md} +2 -2
  17. package/packages/ampcode/commands/test-generate.md +64 -15
  18. package/packages/{opencode/command/testing-anti-patterns.md → ampcode/commands/test-traps.md} +77 -3
  19. package/packages/{droid/commands/root-cause-tracing.md → ampcode/commands/trace-back.md} +3 -3
  20. package/packages/ampcode/commands/{verification-before-completion.md → verify-done.md} +3 -3
  21. package/packages/claude/CLAUDE.md +9 -15
  22. package/packages/claude/agents/code-developer.md +11 -12
  23. package/packages/claude/agents/quality-assurance.md +1 -1
  24. package/packages/claude/commands/diff-review.md +78 -0
  25. package/packages/claude/commands/friction/friction.js +348 -122
  26. package/packages/claude/commands/optimize.md +45 -4
  27. package/packages/claude/commands/refactor.md +33 -1
  28. package/packages/claude/commands/remember.md +107 -46
  29. package/packages/claude/commands/security.md +28 -1
  30. package/packages/claude/commands/stash.md +7 -0
  31. package/packages/claude/commands/test-generate.md +64 -15
  32. package/packages/claude/plugins/live-canvas-marketplace/plugins/live-canvas-channel/package-lock.json +3 -3
  33. package/packages/claude/skills/{systematic-debugging → debug-method}/CREATION-LOG.md +1 -1
  34. package/packages/claude/skills/{systematic-debugging → debug-method}/SKILL.md +9 -9
  35. package/packages/claude/skills/{systematic-debugging → debug-method}/test-academic.md +1 -1
  36. package/packages/claude/skills/{systematic-debugging → debug-method}/test-pressure-1.md +1 -1
  37. package/packages/claude/skills/{systematic-debugging → debug-method}/test-pressure-2.md +1 -1
  38. package/packages/claude/skills/{systematic-debugging → debug-method}/test-pressure-3.md +1 -1
  39. package/packages/claude/skills/{test-driven-development → tdd-flow}/SKILL.md +3 -3
  40. package/packages/claude/skills/{testing-anti-patterns → test-traps}/SKILL.md +77 -3
  41. package/packages/claude/skills/{root-cause-tracing → trace-back}/SKILL.md +3 -3
  42. package/packages/claude/skills/{verification-before-completion → verify-done}/SKILL.md +3 -3
  43. package/packages/droid/AGENTS.md +8 -14
  44. package/packages/{opencode/command/systematic-debugging.md → droid/commands/debug-method.md} +9 -9
  45. package/packages/droid/commands/diff-review.md +78 -0
  46. package/packages/droid/commands/friction/friction.js +348 -122
  47. package/packages/droid/commands/optimize.md +45 -4
  48. package/packages/droid/commands/refactor.md +33 -1
  49. package/packages/droid/commands/remember.md +107 -46
  50. package/packages/droid/commands/security.md +28 -1
  51. package/packages/droid/commands/stash.md +7 -0
  52. package/packages/{opencode/command/test-driven-development.md → droid/commands/tdd-flow.md} +2 -2
  53. package/packages/droid/commands/test-generate.md +64 -15
  54. package/packages/droid/commands/{testing-anti-patterns.md → test-traps.md} +77 -3
  55. package/packages/{opencode/command/root-cause-tracing.md → droid/commands/trace-back.md} +3 -3
  56. package/packages/droid/commands/{verification-before-completion.md → verify-done.md} +3 -3
  57. package/packages/droid/droids/code-developer.md +11 -12
  58. package/packages/droid/droids/quality-assurance.md +1 -1
  59. package/packages/opencode/AGENTS.md +8 -14
  60. package/packages/opencode/agent/code-developer.md +11 -12
  61. package/packages/opencode/agent/quality-assurance.md +1 -1
  62. package/packages/{ampcode/commands/systematic-debugging.md → opencode/command/debug-method.md} +9 -9
  63. package/packages/opencode/command/diff-review.md +78 -0
  64. package/packages/opencode/command/friction/friction.js +348 -122
  65. package/packages/opencode/command/optimize.md +45 -4
  66. package/packages/opencode/command/refactor.md +33 -1
  67. package/packages/opencode/command/remember.md +107 -46
  68. package/packages/opencode/command/security.md +28 -1
  69. package/packages/opencode/command/stash.md +7 -0
  70. package/packages/{ampcode/commands/test-driven-development.md → opencode/command/tdd-flow.md} +2 -2
  71. package/packages/opencode/command/test-generate.md +64 -15
  72. package/packages/{ampcode/commands/testing-anti-patterns.md → opencode/command/test-traps.md} +77 -3
  73. package/packages/{ampcode/commands/root-cause-tracing.md → opencode/command/trace-back.md} +3 -3
  74. package/packages/opencode/command/{verification-before-completion.md → verify-done.md} +3 -3
  75. package/packages/opencode/opencode.jsonc +13 -37
  76. package/packages/subagentic-manual.md +55 -51
  77. package/packages/ampcode/commands/code-review.md +0 -107
  78. package/packages/ampcode/commands/condition-based-waiting.md +0 -122
  79. package/packages/ampcode/commands/debug.md +0 -20
  80. package/packages/ampcode/commands/explain.md +0 -18
  81. package/packages/ampcode/commands/friction.md +0 -139
  82. package/packages/ampcode/commands/git-commit.md +0 -14
  83. package/packages/ampcode/commands/review.md +0 -18
  84. package/packages/claude/commands/debug.md +0 -20
  85. package/packages/claude/commands/explain.md +0 -18
  86. package/packages/claude/commands/friction.md +0 -139
  87. package/packages/claude/commands/git-commit.md +0 -14
  88. package/packages/claude/commands/review.md +0 -18
  89. package/packages/claude/skills/code-review/SKILL.md +0 -107
  90. package/packages/claude/skills/code-review/code-reviewer.md +0 -146
  91. package/packages/claude/skills/condition-based-waiting/SKILL.md +0 -122
  92. package/packages/droid/commands/code-review.md +0 -107
  93. package/packages/droid/commands/condition-based-waiting.md +0 -122
  94. package/packages/droid/commands/debug.md +0 -20
  95. package/packages/droid/commands/explain.md +0 -18
  96. package/packages/droid/commands/friction.md +0 -139
  97. package/packages/droid/commands/git-commit.md +0 -14
  98. package/packages/droid/commands/review.md +0 -18
  99. package/packages/opencode/command/code-review.md +0 -107
  100. package/packages/opencode/command/condition-based-waiting.md +0 -122
  101. package/packages/opencode/command/debug.md +0 -20
  102. package/packages/opencode/command/explain.md +0 -18
  103. package/packages/opencode/command/friction.md +0 -139
  104. package/packages/opencode/command/git-commit.md +0 -14
  105. package/packages/opencode/command/review.md +0 -18
  106. /package/packages/ampcode/commands/{condition-based-waiting → test-traps}/example.ts +0 -0
  107. /package/packages/ampcode/commands/{root-cause-tracing → trace-back}/find-polluter.sh +0 -0
  108. /package/packages/claude/skills/{condition-based-waiting → test-traps}/example.ts +0 -0
  109. /package/packages/claude/skills/{root-cause-tracing → trace-back}/find-polluter.sh +0 -0
  110. /package/packages/droid/commands/{condition-based-waiting → test-traps}/example.ts +0 -0
  111. /package/packages/droid/commands/{root-cause-tracing → trace-back}/find-polluter.sh +0 -0
  112. /package/packages/opencode/command/{condition-based-waiting → test-traps}/example.ts +0 -0
  113. /package/packages/opencode/command/{root-cause-tracing → trace-back}/find-polluter.sh +0 -0
@@ -41,7 +41,7 @@ digraph CodeDeveloper {
41
41
  context_discovery [label="Context Discovery\n(search related code,\ndeps, usages)", fillcolor=lightyellow];
42
42
 
43
43
  // Debug path
44
- use_debug [label="Use /systematic-debugging\nor /root-cause-tracing"];
44
+ use_debug [label="Use /debug-method\nor /trace-back"];
45
45
 
46
46
  // Refactor path
47
47
  use_refactor [label="Use /refactor"];
@@ -54,12 +54,12 @@ digraph CodeDeveloper {
54
54
 
55
55
  // Conditional testing
56
56
  tdd_needed [label="TDD specified\nor tests needed?", shape=diamond];
57
- use_tdd [label="Use /test-driven-development\nor /test-generate"];
57
+ use_tdd [label="Use /tdd-flow\nor /test-generate"];
58
58
 
59
59
  // Validation
60
60
  run_validations [label="Run validations\n(lint, build, tests)"];
61
61
  validations_pass [label="Pass?", shape=diamond];
62
- fix_issues [label="Fix issues\n(use /debug if needed)"];
62
+ fix_issues [label="Fix issues\n(use /debug-method if needed)"];
63
63
  failure_count [label="3+ failures?", shape=diamond];
64
64
 
65
65
  // Security check
@@ -75,8 +75,8 @@ digraph CodeDeveloper {
75
75
  regression_fixable [label="Fixable?", shape=diamond];
76
76
 
77
77
  // Review and complete
78
- code_review [label="Run /code-review"];
79
- verification [label="Run /verification-before-completion", fillcolor=orange];
78
+ code_review [label="Run /diff-review"];
79
+ verification [label="Run /verify-done", fillcolor=orange];
80
80
 
81
81
  // Story-specific
82
82
  update_story [label="Update story\n(checkbox, changelog)"];
@@ -184,15 +184,14 @@ All require `*` prefix. Invocation commands in table above. Additional:
184
184
 
185
185
  | Situation | Delegate To |
186
186
  |-----------|-------------|
187
- | Bug encountered | `/systematic-debugging` first, then `/debug` |
188
- | Error deep in stack | `/root-cause-tracing` |
187
+ | Bug encountered | `/debug-method` (use `/trace-back` when the error is deep in the stack) |
188
+ | Error deep in stack | `/trace-back` |
189
189
  | Refactoring code | `/refactor` |
190
- | Need tests (when required) | `/test-generate` or `/test-driven-development` |
191
- | Writing any test | `/testing-anti-patterns` (avoid mocks, production pollution) |
192
- | Before completion | `/verification-before-completion` |
190
+ | Need tests (when required) | `/test-generate` or `/tdd-flow` |
191
+ | Writing any test | `/test-traps` (avoid mocks, production pollution) |
192
+ | Before completion | `/verify-done` |
193
193
  | After code changes | `/security` |
194
- | Task complete (vs plan) | `/code-review` (checks against requirements/plan) |
195
- | General code review | `/review` (comprehensive quality check) |
194
+ | Task complete / general review | `/diff-review` (diffs branch or staged changes, verifies, fixes confirmed issues, asks on ambiguous ones) |
196
195
  | Performance issues | `/optimize` |
197
196
 
198
197
  You are an autonomous implementation specialist. Execute with precision, delegate appropriately, and communicate clearly when you need guidance or encounter blockers.
@@ -65,7 +65,7 @@ Before any analysis, read (if exists):
65
65
 
66
66
  ## Slash Commands Available
67
67
 
68
- Use these during analysis: `/code-review`, `/security`, `/debug`, `/review`, `/verification-before-completion`
68
+ Use these during analysis: `/diff-review`, `/security`, `/verify-done`
69
69
 
70
70
  ## Analysis Areas
71
71
 
@@ -22,33 +22,27 @@ These subagents are available when using Claude Code CLI. Opencode can reference
22
22
  | system-architect | Architect | Use for system design, architecture documents, technology selection, API design, and infrastructure planning |
23
23
  | ui-designer | UX Expert | Use for UI/UX design, wireframes, prototypes, front-end specifications, and user experience optimization |
24
24
 
25
- ## Opencode Commands (22 total)
25
+ ## Opencode Commands (17 total)
26
26
 
27
27
  | ID | Description | Usage | Auto |
28
28
  |---|---|---|---|
29
29
  | brainstorming | Refines rough ideas into fully-formed designs through collaborative questioning | /brainstorming <session-type> <topic> | false |
30
- | code-review | Reviews implementation against plan or requirements before proceeding | /code-review <review-scope> <focus-areas> | false |
31
- | condition-based-waiting | Replaces arbitrary timeouts with condition polling to wait for actual state changes | /condition-based-waiting <condition-type> <timeout-specs> | false |
32
- | debug | Debug an issue systematically using structured investigation techniques | /debug <issue-description> | - |
33
30
  | docs-builder | Create comprehensive project documentation with structured /docs hierarchy | /docs-builder | false |
34
- | explain | Explain code for someone new to the codebase | /explain <code-section> | - |
35
- | friction | Analyze session logs for failure patterns and behavioral signals | /friction <sessions-path> | - |
36
- | git-commit | Analyze changes and create intelligent git commits | /git-commit | - |
37
31
  | live-canvas | Design UI variations and collect click-to-annotate feedback from the browser (batch mode only on Opencode) | /live-canvas | false |
38
32
  | optimize | Analyze and optimize performance issues | /optimize <target-area> | - |
39
33
  | refactor | Refactor code while maintaining behavior and tests | /refactor <code-section> | - |
40
34
  | remember | Consolidate stashes + friction into project memory | /remember | - |
41
- | review | Comprehensive code review including quality, tests, and architecture | /review | - |
42
- | root-cause-tracing | Systematically traces bugs backward through call stack to identify source | /root-cause-tracing <issue-description> | false |
35
+ | diff-review | Comprehensive code review including quality, tests, and architecture | /diff-review | - |
36
+ | trace-back | Systematically traces bugs backward through call stack to identify source | /trace-back <issue-description> | false |
43
37
  | security | Security vulnerability scan and analysis | /security | - |
44
38
  | ship | Pre-deployment verification checklist | /ship | - |
45
39
  | skill-creator | Guide for creating effective skills and extending Claude capabilities | /skill-creator <skill-type> <skill-description> | false |
46
40
  | stash | Save session context for compaction recovery or handoffs | /stash ["optional-name"] | - |
47
- | systematic-debugging | Four-phase debugging framework - investigate root cause before any fixes | /systematic-debugging <bug-or-error-description> | false |
48
- | test-driven-development | Write test first, watch it fail, write minimal code to pass | /test-driven-development <feature-or-behavior-to-test> | true |
49
- | test-generate | Generate comprehensive test suites for existing code | /test-generate <code-section> | - |
50
- | testing-anti-patterns | Prevents testing mock behavior and production pollution with test-only methods | /testing-anti-patterns <testing-scenario> | true |
51
- | verification-before-completion | Requires running verification commands before making any success claims | /verification-before-completion <work-to-verify> | true |
41
+ | debug-method | Four-phase debugging framework - investigate root cause before any fixes | /debug-method <bug-or-error-description> | false |
42
+ | tdd-flow | Write test first, watch it fail, write minimal code to pass | /tdd-flow <feature-or-behavior-to-test> | true |
43
+ | test-generate | Generate tests, run them, verify each one actually exercises the code | /test-generate <file> | - |
44
+ | test-traps | Prevents testing mock behavior and production pollution with test-only methods | /test-traps <testing-scenario> | true |
45
+ | verify-done | Requires running verification commands before making any success claims | /verify-done <work-to-verify> | true |
52
46
 
53
47
  All resources are auto-discovered from frontmatter in their respective directories:
54
48
  - **Agents**: `./agent/*.md`
@@ -45,7 +45,7 @@ digraph CodeDeveloper {
45
45
  context_discovery [label="Context Discovery\n(search related code,\ndeps, usages)", fillcolor=lightyellow];
46
46
 
47
47
  // Debug path
48
- use_debug [label="Use /systematic-debugging\nor /root-cause-tracing"];
48
+ use_debug [label="Use /debug-method\nor /trace-back"];
49
49
 
50
50
  // Refactor path
51
51
  use_refactor [label="Use /refactor"];
@@ -58,12 +58,12 @@ digraph CodeDeveloper {
58
58
 
59
59
  // Conditional testing
60
60
  tdd_needed [label="TDD specified\nor tests needed?", shape=diamond];
61
- use_tdd [label="Use /test-driven-development\nor /test-generate"];
61
+ use_tdd [label="Use /tdd-flow\nor /test-generate"];
62
62
 
63
63
  // Validation
64
64
  run_validations [label="Run validations\n(lint, build, tests)"];
65
65
  validations_pass [label="Pass?", shape=diamond];
66
- fix_issues [label="Fix issues\n(use /debug if needed)"];
66
+ fix_issues [label="Fix issues\n(use /debug-method if needed)"];
67
67
  failure_count [label="3+ failures?", shape=diamond];
68
68
 
69
69
  // Security check
@@ -79,8 +79,8 @@ digraph CodeDeveloper {
79
79
  regression_fixable [label="Fixable?", shape=diamond];
80
80
 
81
81
  // Review and complete
82
- code_review [label="Run /code-review"];
83
- verification [label="Run /verification-before-completion", fillcolor=orange];
82
+ code_review [label="Run /diff-review"];
83
+ verification [label="Run /verify-done", fillcolor=orange];
84
84
 
85
85
  // Story-specific
86
86
  update_story [label="Update story\n(checkbox, changelog)"];
@@ -188,15 +188,14 @@ All require `*` prefix. Invocation commands in table above. Additional:
188
188
 
189
189
  | Situation | Delegate To |
190
190
  |-----------|-------------|
191
- | Bug encountered | `/systematic-debugging` first, then `/debug` |
192
- | Error deep in stack | `/root-cause-tracing` |
191
+ | Bug encountered | `/debug-method` (use `/trace-back` when the error is deep in the stack) |
192
+ | Error deep in stack | `/trace-back` |
193
193
  | Refactoring code | `/refactor` |
194
- | Need tests (when required) | `/test-generate` or `/test-driven-development` |
195
- | Writing any test | `/testing-anti-patterns` (avoid mocks, production pollution) |
196
- | Before completion | `/verification-before-completion` |
194
+ | Need tests (when required) | `/test-generate` or `/tdd-flow` |
195
+ | Writing any test | `/test-traps` (avoid mocks, production pollution) |
196
+ | Before completion | `/verify-done` |
197
197
  | After code changes | `/security` |
198
- | Task complete (vs plan) | `/code-review` (checks against requirements/plan) |
199
- | General code review | `/review` (comprehensive quality check) |
198
+ | Task complete / general review | `/diff-review` (diffs branch or staged changes, verifies, fixes confirmed issues, asks on ambiguous ones) |
200
199
  | Performance issues | `/optimize` |
201
200
 
202
201
  You are an autonomous implementation specialist. Execute with precision, delegate appropriately, and communicate clearly when you need guidance or encounter blockers.
@@ -69,7 +69,7 @@ Before any analysis, read (if exists):
69
69
 
70
70
  ## Slash Commands Available
71
71
 
72
- Use these during analysis: `/code-review`, `/security`, `/debug`, `/review`, `/verification-before-completion`
72
+ Use these during analysis: `/diff-review`, `/security`, `/verify-done`
73
73
 
74
74
  ## Analysis Areas
75
75
 
@@ -1,11 +1,11 @@
1
1
  ---
2
- name: systematic-debugging
2
+ name: debug-method
3
3
  description: Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes - four-phase framework (root cause investigation, pattern analysis, hypothesis testing, implementation) that ensures understanding before attempting solutions
4
- usage: /systematic-debugging <bug-or-error-description>
4
+ usage: /debug-method <bug-or-error-description>
5
5
  auto_trigger: false
6
6
  ---
7
7
 
8
- # Systematic Debugging
8
+ # Debug Method
9
9
 
10
10
  ## Overview
11
11
 
@@ -113,7 +113,7 @@ You MUST complete each phase before proceeding to the next.
113
113
 
114
114
  **WHEN error is deep in call stack:**
115
115
 
116
- **REQUIRED SUB-SKILL:** Use root-cause-tracing for backward tracing technique
116
+ **REQUIRED SUB-SKILL:** Use trace-back for backward tracing technique
117
117
 
118
118
  **Quick version:**
119
119
  - Where does bad value originate?
@@ -178,7 +178,7 @@ You MUST complete each phase before proceeding to the next.
178
178
  - Automated test if possible
179
179
  - One-off test script if no framework
180
180
  - MUST have before fixing
181
- - **REQUIRED SUB-SKILL:** Use test-driven-development for writing proper failing tests
181
+ - **REQUIRED SUB-SKILL:** Use tdd-flow for writing proper failing tests
182
182
 
183
183
  2. **Implement Single Fix**
184
184
  - Address the root cause identified
@@ -280,13 +280,13 @@ If systematic investigation reveals issue is truly environmental, timing-depende
280
280
  ## Integration with Other Skills
281
281
 
282
282
  **This skill requires using:**
283
- - **root-cause-tracing** - REQUIRED when error is deep in call stack (see Phase 1, Step 5)
284
- - **test-driven-development** - REQUIRED for creating failing test case (see Phase 4, Step 1)
283
+ - **trace-back** - REQUIRED when error is deep in call stack (see Phase 1, Step 5)
284
+ - **tdd-flow** - REQUIRED for creating failing test case (see Phase 4, Step 1)
285
285
 
286
286
  **Complementary skills:**
287
287
  - **defense-in-depth** - Add validation at multiple layers after finding root cause
288
- - **condition-based-waiting** - Replace arbitrary timeouts identified in Phase 2
289
- - **verification-before-completion** - Verify fix worked before claiming success
288
+ - **test-traps** (Anti-Pattern 6) - Replace arbitrary timeouts identified in Phase 2
289
+ - **verify-done** - Verify fix worked before claiming success
290
290
 
291
291
  ## Real-World Impact
292
292
 
@@ -0,0 +1,78 @@
1
+ ---
2
+ name: diff-review
3
+ description: Review diff [file, branch, or range]
4
+ usage: /diff-review
5
+ argument-hint: [file, branch (e.g. main), range (main..HEAD), or empty]
6
+ allowed-tools: Read, Edit, Grep, Glob, Bash(git diff *), Bash(git log *), Bash(git show *), Bash(git status *), Bash(git grep *), Bash(git rev-parse *), Bash(git merge-base *), Bash(rg *)
7
+ ---
8
+ Review $ARGUMENTS. Interpret in this order:
9
+ 1. **Empty** → staged diff (`git diff --staged`); if empty, working-tree diff
10
+ (`git diff`).
11
+ 2. **A range** like `main..HEAD` or `origin/main...HEAD` → `git diff <range>`.
12
+ 3. **A single ref** (branch / tag / SHA — confirm with `git rev-parse
13
+ --verify`) → diff that ref's merge-base against `HEAD` (i.e. everything on
14
+ the current branch since it diverged: `git diff $(git merge-base <ref>
15
+ HEAD)..HEAD`). This is the common "review my branch before merging" path.
16
+ 4. **A file or directory path** → that target.
17
+ 5. Otherwise → ask.
18
+
19
+ The diff is the subject; widen to surrounding code only as needed to judge a
20
+ hunk. For multi-commit ranges, also skim `git log <range>` to understand
21
+ intent before judging.
22
+
23
+ ## Check For
24
+ - **Bugs needing a fix.** Logic errors, off-by-one, null/undefined paths,
25
+ races, wrong defaults, broken edge cases. Concrete failure modes only — not
26
+ vibes.
27
+ - **Dead code.** Unreferenced functions / vars / imports / params, unreachable
28
+ branches, commented-out blocks, legacy paths the diff just obsoleted.
29
+ `git grep` the symbol before flagging — easy to be wrong.
30
+ - **Loose ends.** TODO / FIXME / XXX added by this diff, half-finished
31
+ branches, silently swallowed errors, stub bodies, mocked-out paths,
32
+ "temporary" names, abandoned feature flags.
33
+ - **Correctness.** Edge cases, error handling, type / contract violations,
34
+ broken invariants.
35
+ - **Security.** OWASP Top 10, auth, data exposure. (`/security` for depth.)
36
+ - **Performance.** N+1, blocking calls in hot paths, unbounded loops, indexes
37
+ the diff actually touches.
38
+ - **Maintainability.** Complexity, naming, duplication — only when material.
39
+
40
+ ## Output Format
41
+ ### 🚨 Critical (blocks merge)
42
+ ### ⚠️ Warnings (should fix)
43
+ ### 💡 Suggestions (nice to have)
44
+
45
+ Each finding: **Location** (`file:line`), **What's wrong**, **Why it matters**,
46
+ **Concrete fix** — not "consider improving".
47
+
48
+ ## After the review — verify, then fix
49
+
50
+ Findings are claims, not facts. Validate before acting; validate again after.
51
+
52
+ **Verify each claim.** Re-read the cited `file:line` in context. For
53
+ dead-code or unused-symbol claims, `git grep` the name across the repo before
54
+ trusting it. Mark each **confirmed**, **false positive** (with reason), or
55
+ **uncertain**.
56
+
57
+ **Fix what's confirmed and unambiguous** — minimal shape, one obvious way, no
58
+ change to a public API / response / caller contract. Apply directly. After
59
+ each edit, re-read the changed region and confirm it does what you intended
60
+ without breaking nearby logic. A fix isn't done until you've grounded it the
61
+ same way you grounded the claim.
62
+
63
+ **Stop and ask** when any of these hold (HITL gates — not all the time, only
64
+ here):
65
+ - the finding is **uncertain** after grounding,
66
+ - the fix has **multiple reasonable shapes** (e.g. delete-vs-keep-behind-flag,
67
+ extract-vs-inline, patch-vs-rewrite) — present options with tradeoffs, not a
68
+ chosen path,
69
+ - it **affects downstream** (signatures, response shape, schema, any caller
70
+ contract) or removes a public/exported symbol, or
71
+ - the "dead code" looks intentionally kept (stub for upcoming work, framework
72
+ hook, documented extension point) — confirm before deleting.
73
+
74
+ Final report: **confirmed-and-fixed** · **confirmed-but-asking** (why +
75
+ options) · **false-positive** (why) · **uncertain** (what's needed to decide).
76
+
77
+ End with a one-line verdict: **Ready to merge? Yes / No / With fixes** — and
78
+ the reason in a sentence.