/civitai-review

name: civitai-review
description: Run the five Civitai review agents (reuse, safety, performance, tests, intent) over a feature segment in the main Next.js app (src/), consolidate their findings, and drive the fix loop to ship. Use before calling a segment done, or when asked to review main-app work.

Civitai segment review — main app (`src/`)

The standard pre-completion review for the main Next.js app. **A segment is not done until this has run and its findings are resolved.**

The conventions being enforced are the root [`CLAUDE.md`](../../../CLAUDE.md) and the docs it points at. For work in `apps/moderator`, `apps/auth` or `apps/creator-studio`, use `svelte-review` instead — these agents do not cover SvelteKit and will produce noise there.

**These five lanes are pre-authorised. They do not count against a standing instruction not to spawn subagents unasked** — running them needs no separate permission, and neither does chasing a lane that goes idle. That covers the review lanes only; everything else about spawning is unchanged. The pre-authorisation lives here so it travels with the skill rather than through a relay: an agent cannot tell a real global ruling from a mistaken one by reading someone's summary of it, so twice on 2026-08-19 agents correctly declined a relayed "he already said yes" and raised it instead.

This complements the built-in `/code-review`, which already handles generic correctness. What these five add is Civitai-specific: *which* service, *which* component, *which* trap.

0. Set up the review worktree

Review runs in its own throwaway worktree, detached at the head under review, and **nothing is written to it** — the implementer owns the tree the code was authored in.

🔴 **If that head is based on an integration branch rather than `main`, this skill and its five agents do not exist in the tree.** They are tracked in the repo, so a worktree at a commit predating their merge contains neither `.claude/skills/civitai-review/` nor `.claude/agents/civitai-*.md`: the skill is not found and the `subagent_type` names do not resolve. Work stacked on a `feat/…` integration branch is the normal case here, not the exception, so expect this rather than treating it as a broken install. The failure is upstream of anything this file can say — by the time you could read a workaround here, you would already have found the file.

**Skip this step when the head under review is based on `main`** — the agents are already in the tree and the checkout is a no-op. This step is for integration-branch work only.

Otherwise, bring them in from `main` before spawning anything:

git checkout origin/main -- .claude

The tree is detached and throwaway, so a dirty `.claude` in it costs nothing and can never reach a PR. Do not install the agents into `~/.claude/` instead: that is a second copy free to drift from the repo's, and the repo's is the authoritative one.

⚠️ **That checkout STAGES the files, so the next `git checkout --detach` aborts** with local changes that would be overwritten — which is how you find out, halfway through moving the tree to the next review. Unstage and remove them first:

git reset -q
rm -rf .claude/agents/civitai-*.md .claude/skills/civitai-review
git checkout --detach <next-sha>
git checkout origin/main -- .claude    # re-apply, if the new head predates the skill

1. Scope the segment

**Determine the base first — it is usually not `main`.** Work stacks on a feature integration branch far more often than it sits directly on `main`, and diffing against `main` drags in every unrelated commit that landed on the integration branch. Take the base from the invoking request, or read it off the PR:

gh pr view <n> --json baseRefName -q .baseRefName

Then scope against that base, and say what it is before spawning anything:

BASE=origin/feat/<integration-branch>   # whatever the PR is actually based on
git diff --stat $BASE...HEAD -- src/
git status --short

A segment is one slice of work — a page, a router and its service, a feature. If the diff spans several unrelated slices, review them one at a time; findings from a mixed diff are hard to act on. Include uncommitted changes: the review exists to run *before* the commit.

Also locate the **intent doc** now, so the intent reviewer isn't the one to discover it's missing:

C:\Dev\Repos\work\model-share\_local\docs\plans\<feature>.md

Absolute path, from any worktree. 🔴 Never resolve `_local/` relatively — it exists only in the primary worktree, and a relative write silently creates a second private copy that nobody else reads.

2. Fan out — all five at once, in one message

🔴 **Launch every lane in a single message with multiple tool uses.** They are independent and share no state.

A numbered list of steps reads as an instruction to run them one after another, so this is stated rather than left to inference: **do not spawn them sequentially.** A five-lane review that takes five times as long is the thing that makes people stop running it, and a review nobody runs finds nothing.

| Agent | Reviews | | --- | --- | | `civitai-reuse-review` | Components/services/hooks rebuilt when they exist; pre-existing duplicate services | | `civitai-correctness-review` | Auth scoping, money paths, PII, NSFW gating, failure paths | | `civitai-perf-review` | N+1s, unindexed queries, feed-path cost, cache stampedes, bundle weight | | `civitai-test-review` | Tests that pass regardless of the code under them | | `civitai-intent-review` | Did the PR do what was actually asked |

The first four are the **code lanes** — same input, four questions, launched together. `civitai-intent-review` launches alongside them but is **different in kind**: it reads the request rather than the code, and its findings stay a separate section at step 3.

Give each the same scope: the file list, what the segment is meant to do, and anything it can't recover from the code — what was deliber