/review

description: "Before merging a branch: a code review with evidence for every finding and no false alarms — a domain compliance review (`--domain tax|legal|hr-ai|api|accounting|rcm|msp|procurement|voice`), or a smart-contract audit (`--contracts`). Code review = 12 angles + skeptical triage (3 rounds + arbiter); `--deep` triages every P0/P1 angle, not just security/reliability; creates or closes gate:code. Domain review = the matching compliance reviewer writes docs/sec-threats/TM-<domain>-<slug>.md and raises its gate. Contracts = smart-contract-auditor writes docs/security/AUDIT-<slug>.md."
argument-hint: "[PR/branch name | --deep | --domain <tax|legal|hr-ai|api|accounting|rcm|msp|procurement|voice> [arch-slug] | --contracts [--package] [path ...]]"
user-invocable: true
disable-model-invocation: true
allowed-tools: Read, Write, Bash, Glob, Grep, Agent, advisor_20260301
model: sonnet
advisor-model: claude-opus-5
advisor-max-uses: 2
beta: advisor-tool-2026-03-01

You are the great_cto `/review` command. Two modes:

• **Code review** (default) — 12 independent angles over the branch diff, then skeptical triage.
• **Domain compliance review** (`--domain <name>`) — one regulated-domain reviewer against the ARCH doc.
• **Smart-contract audit** (`--contracts [path ...]`) — the Solidity/EVM code that exists, audited by `smart-contract-auditor`.

Traceability (REQ → use-case → task → test) is **`/trace`**, not `/review`.

Contracts mode (`--contracts` — early branch, exits before the code review)

Audits Solidity/EVM code that already exists — no ARCH doc needed, unlike domain mode. With no path, the auditor's own scope rule picks the production contracts and deploy scripts; a named path is always in scope.

Use the Agent tool with `subagent_type: smart-contract-auditor` and prompt:

> Audit the smart contracts in this repository{ — only: <paths> }. Follow your steps: > scope, build and tool inventory, the always-run analyzers, the system map, the > vector-by-vector review, four-gate proof with a Foundry PoC for Critical/High, deep > checks only if the contracts hold value or `--deep` was passed. Write > `docs/security/AUDIT-<slug>.md` and the verdict line.

With `--package` (code headed to an external audit) add to that prompt:

> This is prepare mode. Also write the threat model, the invariant specification, a > Foundry invariant suite under `test/invariant/<slug>/` that you ran, and the auditors' > package in `docs/security/audit-package-<slug>/` (Steps 4, 5b, 7, 9).

Then report in ≤ 6 lines: the AUDIT file path (and the package folder with `--package`), Critical / High / Medium counts, invariants tested / specified, the tools that did **not** run, the verdict (PASS | FAIL | BLOCKED), and the next action — FAIL → fix and re-run `/review --contracts`; BLOCKED → the build or tool problem to fix first. **Do not continue into the code review below.**

Domain mode (`--domain` — early branch, exits before the code review)

| Domain | Also accepts | Reviewer agent | Writes | What it checks | Gate · signs off | |--------|--------------|----------------|--------|----------------|------------------| | `tax` | `tax-review` | `tax-reviewer` | `TM-tax-{slug}.md` | IRS MeF e-file schema, Form 8879, PTIN / Circular 230, IRC §7216 consent | `gate:tax-filing-signoff` · EA/CPA compliance lead | | `legal` | `upl`, `upl-check` | `legal-reviewer` | `TM-legal-{slug}.md` | Unauthorized practice of law gating, IOLTA/trust accounting, privilege, conflict screening, e-filing redaction | `gate:upl-review` | | `hr-ai` | `hrai`, `aedt`, `aedt-bias-audit` | `hr-ai-reviewer` | `TM-hrai-{slug}.md` | AEDT scope; NYC LL 144, EEOC, Illinois AIVIA, Colorado SB 205, EU AI Act Annex III; bias-audit pipeline (4/5 rule, intersectional) | `gate:aedt-audit` | | `api` | `api-platform`, `api-contract-review` | `api-platform-reviewer` | `TM-api-{slug}.md` | Rate limits, OAuth scopes, webhook signing, idempotency, Sunset/deprecation, pagination, error envelope, versioning — critical before v1 GA | `gate:api-contract` | | `accounting` | `close`, `close-review` | `accounting-reviewer` | `TM-accounting-{slug}.md` | Double-entry integrity, ASC 606 revenue recognition, period lock, SOX ITGC | `gate:close-signoff` · controller / finance lead | | `rcm` | `coding`, `coding-audit` | `rcm-reviewer` | `TM-rcm-{slug}.md` | ICD-10-CM/CPT/HCPCS autonomous coding: False Claims Act exposure (upcoding/unbundling), NCCI PTP + MUE, LCD/NCD medical necessity, modifiers, HIPAA minimum-necessary | `gate:coding-signoff` · certified coder (CPC/CCS) | | `msp` | `msp-review` | `msp-reviewer` | `TM-msp-{slug}.md` | Client isolation, credential vaulting, SLA tracking, incident escalation | `gate:msp-controls` · security lead / MSP operations | | `procurement` | `procurement-review` | `procurement-reviewer` | `TM-procurement-{slug}.md` | Three-way match, segregation of duties, OFAC screening, SOX procurement controls | `gate:procurement-controls` · finance / controller | | `voice` | `voice-compliance` | `voice-ai-reviewer` | `TM-voice-{slug}.md` | TCPA, STIR/SHAKEN, state recording consent, EU AI Act Art. 50, synthetic-voice deepfake laws | `gate:voice-compliance` · regulatory lead |

The "Also accepts" names are the former standalone commands (`/tax-review`, `/upl-check`, …), kept as aliases so `/review --domain upl-check` still means `legal`. A leading `/` is ignored.

Step D1 — Resolve the domain and the ARCH doc

DOMAIN=""; SLUG=""; _prev=""
for arg in "$@"; do
  case "$arg" in
    --domain=*) DOMAIN="${arg#--domain=}" ;;
    --*) ;;
    *) if [ "$_prev" = "--domain" ]; then DOMAIN="$arg"; elif [ -z "$SLUG" ]; then SLUG="$arg"; fi ;;
  esac
  _prev="$arg"
done

# >>> resolve_domain
resolve_domain() {
  D="${1#/}"; D=$(printf '%s' "$D" | tr '[:upper:]' '[:lower:]')
  SKIP_WITHOUT_SIGNALS=true
  case "$D" in
    tax|tax-review)
      D=tax; AGENT=tax-reviewer; TM=tax; GATE=gate:tax-filing-signoff
      SIGNALS='\bptin\b|circular 230|form