/review

description: "12-angle code review + skeptical triage (3-round + arbiter) for security/reliability P0/P1 findings, OR traceability tree. Default: review current branch vs main. `--deep`: triage ALL P0/P1 angles (not just security). With `trace <id>`: render REQ → IMPL → TEST tree for impact analysis. Creates or closes gate:code for approval-level: strict."
argument-hint: "[PR/branch name | --deep | trace <bd-id> | trace <feature-slug>]"
user-invocable: true
disable-model-invocation: true
allowed-tools: Read, Bash, Glob, Grep, advisor_20260301
model: sonnet
advisor-model: claude-opus-4-8
advisor-max-uses: 2
beta: advisor-tool-2026-03-01

You are a senior engineering team conducting a 12-angle code review. Each angle is independent and focuses exclusively on its domain.

Trace mode (early branch — exits before review runs)

If `$1 = trace` → render the requirement → use-case → task → test traceability for the supplied bd id or feature slug, then stop. This is a thin alias for the canonical **`/trace`** command (governance Phase 4) — one engine (`scripts/lib/trace.mjs`): layered rationale + impact + coverage gaps, not a raw `bd dep tree` dump.

if [ "$1" = "trace" ]; then
  bd --help >/dev/null 2>&1 || { echo "bd not installed — traceability requires Beads."; echo "Fallback: grep '^- \\[ \\] REQ-' docs/architecture/ARCH-*.md"; exit 1; }

  TARGET="${2:-}"
  if [ -z "$TARGET" ]; then
    echo "Usage: /review trace <bd-id|feature-slug>   (alias of /trace)"
    echo "  /review trace bd-xyz              # rationale + impact for this node"
    echo "  /review trace feature-checkout    # coverage audit for the feature"
    exit 0
  fi

  PD=$(ls -d ~/.claude/plugins/cache/local/great_cto/*/ 2>/dev/null | sort -V | tail -1 | sed 's|/$||'); [ -z "$PD" ] && PD=.
  TRACE() { node "$PD/scripts/lib/trace.mjs" "$@" 2>/dev/null || node scripts/lib/trace.mjs "$@"; }

  # feature-<slug> → coverage audit; otherwise node-centric trace.
  if echo "$TARGET" | grep -q "^feature-"; then
    TRACE feature "${TARGET#feature-}"
  else
    TRACE "$TARGET"
  fi
  exit $?
fi

Setup

source .great_cto/env.sh 2>/dev/null || export PATH="/opt/homebrew/bin:$HOME/.local/bin:/usr/local/bin:$PATH"
REVIEW_MODE=$(grep "^approval-level:" .great_cto/PROJECT.md 2>/dev/null | awk '{print $2}'); REVIEW_MODE=${REVIEW_MODE:-auto}
TYPE=$(grep "^primary:" .great_cto/PROJECT.md 2>/dev/null | awk '{print $2}')
ARCHETYPE=$(grep "^archetype:" .great_cto/PROJECT.md 2>/dev/null | awk '{print $2}'); ARCHETYPE=${ARCHETYPE:-web-service}

# Parse --deep flag (triage all P0/P1 angles, not just security/reliability)
DEEP_TRIAGE=false
DIFF_TARGET=""
for arg in "$@"; do
  case "$arg" in
    --deep) DEEP_TRIAGE=true ;;
    --*) ;;  # unknown flag, ignore
    *) [ -z "$DIFF_TARGET" ] && DIFF_TARGET="$arg" ;;
  esac
done

# Get diff scope
if [ -n "$DIFF_TARGET" ]; then
  git diff main..."$DIFF_TARGET" --name-only 2>/dev/null | head -30
  DIFF=$(git diff main..."$DIFF_TARGET" 2>/dev/null | head -2000)
else
  BASE=$(git merge-base HEAD main 2>/dev/null || echo "HEAD~5")
  git diff "$BASE"..HEAD --name-only 2>/dev/null | head -30
  DIFF=$(git diff "$BASE"..HEAD 2>/dev/null | head -2000)
fi
echo "Files changed: $(git diff "$BASE"..HEAD --name-only 2>/dev/null | wc -l)"
echo "Deep triage mode: $DEEP_TRIAGE  (triage ALL P0/P1 angles, not just 2/4/7/9)"

# Detect design system (for Angle 12)
DESIGN_SYSTEM="none"
grep -rl "MaterialTheme\|androidx.compose.material3" . --include="*.kt" 2>/dev/null | head -1 | grep -q . && DESIGN_SYSTEM="material3"
grep -rl "tailwind\|@apply\|className=" . --include="*.tsx" --include="*.jsx" --include="*.css" 2>/dev/null | head -1 | grep -q . && DESIGN_SYSTEM="tailwind"
grep -rl "SwiftUI\|\.foregroundStyle\|Color\.accentColor" . --include="*.swift" 2>/dev/null | head -1 | grep -q . && DESIGN_SYSTEM="swiftui"
grep -rl "StyleSheet\.create\|useTheme\|ThemeProvider" . --include="*.tsx" --include="*.ts" 2>/dev/null | head -1 | grep -q . && [ "$DESIGN_SYSTEM" = "none" ] && DESIGN_SYSTEM="rn-custom"
echo "Design system detected: $DESIGN_SYSTEM"

Cache discipline

Setup above produces the **stable prefix** shared across all 12 angles: archetype, design-system detection, and the full `$DIFF`. When you run angles as separate evaluations, preserve this layout **verbatim** — same order, same values, no re-detection. The only thing that varies between invocations is the angle-specific `**Focus**` block below. Reordering Setup or re-reading the diff per angle forfeits prefix caching across the 12 angles.

Finding discipline — coverage before filter (applies to every angle)

This harness has two stages: **finding** (the 12 angles below) and **filter** (Skeptical Triage + arbiter, further down). They have different jobs — do not conflate them.

At the **finding stage your job is coverage, not filtering.** Report every issue you find, including ones you are uncertain about or judge low-severity. Do not silently drop a finding because it feels minor or you are not fully sure — the triage stage exists precisely to rank and discard. It is better to surface a finding that triage later filters out than to drop a real bug at the finding stage.

Concretely, for **every** angle:

• Emit a one-line entry for **each** finding at **every** severity — P0, P1 **and P2** — plus

any borderline/uncertain item, not just P0/P1. (Below, the per-angle output details P0/P1; additionally list each P2 / uncertain item as a single `FILE:LINE — <issue> [P2|conf:low]` line so it reaches triage rather than collapsing to a bare count.)

• Tag every finding with **severity** (P0/P1/P2) AND a **confidence** (high / med / low). The

downstream triage uses both to rank; your job is to populate them honestly, not to pre-filter.

• Do not generalize an instruction from one item to the next — review **every** changed hunk,

not a representative sample.

Why this matters: the current model investigates as deeply as before but, told