/review

name: workflows:review
description: Perform exhaustive code reviews using multi-agent analysis, ultra-thinking, and worktrees
argument-hint: "[PR number, GitHub URL, branch name, or latest]"

Review Command

<command_purpose> Perform exhaustive code reviews using multi-agent analysis, ultra-thinking, and Git worktrees for deep local inspection. </command_purpose>

Introduction

<role>Senior Code Review Architect with expertise in security, performance, architecture, and quality assurance</role>

Prerequisites

<requirements>

• Git repository with GitHub CLI (`gh`) installed and authenticated
• Clean main/master branch
• Proper permissions to create worktrees and access the repository
• For document reviews: Path to a markdown file or document

</requirements>

Main Tasks

1. Determine Review Target & Setup (ALWAYS FIRST)

<review_target> #$ARGUMENTS </review_target>

<thinking> First, I need to determine the review target type and set up the code for analysis. </thinking>

Immediate Actions:

<task_list>

• [ ] Determine review type: PR number (numeric), GitHub URL, file path (.md), or empty (current branch)
• [ ] Check current git branch
• [ ] If ALREADY on the target branch (PR branch, requested branch name, or the branch already checked out for review) → proceed with analysis on current branch
• [ ] If DIFFERENT branch than the review target → offer to use worktree: "Use git-worktree skill for isolated Call `skill: git-worktree` with branch name
• [ ] Fetch PR metadata using `gh pr view --json` for title, body, files, linked issues
• [ ] Set up language-specific analysis tools
• [ ] Prepare security scanning environment
• [ ] Make sure we are on the branch we are reviewing. Use gh pr checkout to switch to the branch or manually checkout the branch.

Ensure that the code is ready for analysis (either in worktree or on current branch). ONLY then proceed to the next step.

</task_list>

Parallel Agents to review the PR:

<parallel_tasks>

Run ALL or most of these agents at the same time:

1. Task kieran-rails-reviewer(PR content) 2. Task dhh-rails-reviewer(PR title) 3. If turbo is used: Task rails-turbo-expert(PR content) 4. Task git-history-analyzer(PR content) 5. Task dependency-detective(PR content) 6. Task pattern-recognition-specialist(PR content) 7. Task architecture-strategist(PR content) 8. Task code-philosopher(PR content) 9. Task security-sentinel(PR content) 10. Task performance-oracle(PR content) 11. Task devops-harmony-analyst(PR content) 12. Task data-integrity-guardian(PR content) 13. Task agent-native-reviewer(PR content) - Verify new features are agent-accessible

</parallel_tasks>

Conditional Agents (Run if applicable):

<conditional_agents>

These agents are run ONLY when the PR matches specific criteria. Check the PR files list to determine if they apply:

**If PR contains database migrations (db/migrate/*.rb files) or data backfills:**

14. Task data-migration-expert(PR content) - Validates ID mappings match production, checks for swapped values, verifies rollback safety 15. Task deployment-verification-agent(PR content) - Creates Go/No-Go deployment checklist with SQL verification queries

**When to run migration agents:**

• PR includes files matching `db/migrate/*.rb`
• PR modifies columns that store IDs, enums, or mappings
• PR includes data backfill scripts or rake tasks
• PR changes how data is read/written (e.g., changing from FK to string column)
• PR title/body mentions: migration, backfill, data transformation, ID mapping

**What these agents check:**

• `data-migration-expert`: Verifies hard-coded mappings match production reality (prevents swapped IDs), checks for orphaned associations, validates dual-write patterns
• `deployment-verification-agent`: Produces executable pre/post-deploy checklists with SQL queries, rollback procedures, and monitoring plans

</conditional_agents>

4. Ultra-Thinking Deep Dive Phases

<ultrathink_instruction> For each phase below, spend maximum cognitive effort. Think step by step. Consider all angles. Question assumptions. And bring all reviews in a synthesis to the user.</ultrathink_instruction>

<deliverable> Complete system context map with component interactions </deliverable>

Phase 3: Stakeholder Perspective Analysis

<thinking_prompt> ULTRA-THINK: Put yourself in each stakeholder's shoes. What matters to them? What are their pain points? </thinking_prompt>

<stakeholder_perspectives>

1. **Developer Perspective** <questions>

• How easy is this to understand and modify?
• Are the APIs intuitive?
• Is debugging straightforward?
• Can I test this easily? </questions>

2. **Operations Perspective** <questions>

• How do I deploy this safely?
• What metrics and logs are available?
• How do I troubleshoot issues?
• What are the resource requirements? </questions>

3. **End User Perspective** <questions>

• Is the feature intuitive?
• Are error messages helpful?
• Is performance acceptable?
• Does it solve my problem? </questions>

4. **Security Team Perspective** <questions>

• What's the attack surface?
• Are there compliance requirements?
• How is data protected?
• What are the audit capabilities? </questions>

5. **Business Perspective** <questions>

• What's the ROI?
• Are there legal/compliance risks?
• How does this affect time-to-market?
• What's the total cost of ownership? </questions> </stakeholder_perspectives>

Phase 4: Scenario Exploration

<thinking_prompt> ULTRA-THINK: Explore edge cases and failure scenarios. What could go wrong? How does the system behave under stress? </thinking_prompt>

<scenario_checklist>

• [ ] **Happy Path**: Normal operation with valid inputs
• [ ] **Invalid Inputs**: Null, empty, malformed data
• [ ] **Boundary Conditions**: Min/max values, empty collections
• [ ] **Concurrent Access**: Race conditions, deadlocks
• [ ] **Scale Testing**: 10x, 100x, 1000x normal load
• [ ] **