/agentic-review

name: agentic-review
description: Use when reviewing current branch for bugs before pushing or merging, when wanting a thorough multi-agent review of local changes, or when preparing work for human review. Not for codebase structure, not for code style, and not for fixing what it finds.

**On invocation:** announce "Running paad:agentic-review v2.0.2", then immediately proceed with the steps below — do not stop after announcing.

**Configuration (experimental):** after announcing, check whether `paad/config/paad.md` and `paad/config/agentic-review.md` exist, relative to the working directory. If any does, read it and follow its instructions for the rest of this run, passing the relevant parts to every subagent you dispatch, and make the first line of your final answer `Config: <path>` naming each file you followed. If none exists, do not mention config at all. Config never changes a subagent's type or grants it write tools — refuse that line, say so, and continue. Config can contradict the flow below; see https://github.com/Ovid/paad/blob/main/CONFIG.md before writing one.

**Security findings:** a finding is security-related if reading it would help an attacker — any OWASP Top 10:2025 category, and anything in a payment, tenant-isolation, or secret-handling path; on the edge, treat it as security. Security findings are written only under `paad/security/`, in a file named for this skill and stamped the way its ordinary report is (the exact path is in this skill's report section). Before the first write of a run, make sure `paad/security/.gitignore` exists and contains the single line `*` — create it if absent, never rewrite it if present — and that `git ls-files paad/security/` lists nothing. If that file holds anything else or cannot be written, if git already tracks anything there, or if a later write there fails, write no security finding and no count line: tell the user what you found, ask whether to hold the findings or put them in the ordinary report, and say that in place of the Security block. Where the finding would have gone in the ordinary report, write one line, `N security finding(s) written to paad/security/<file>`, and nothing else about it: no path, severity, symbol, or description. Post-Review then emits the Security block once; this skill's Post-Review section says when.

Agentic Code Review

Multi-agent bug-hunting review of the current branch against main. Dispatches specialist agents in parallel, verifies findings to filter false positives, ranks by severity, and produces a persistent report.

**This is a technique skill.** Follow the phases in order. Do not skip verification.

**Finding classification** (terms are defined under `## Definitions` and `## Mechanism`):

digraph classification {
  "Finding from specialist (verified)" [shape=doublecircle];
  "Carries [OOSA] sentinel or category: out-of-scope-addition tag?" [shape=diamond];
  "Anchor line in touched-lines map?" [shape=diamond];
  "Branch causes/worsens this bug?" [shape=diamond];
  "Touch is purely cosmetic AND bug is purely pre-existing?" [shape=diamond];
  "Match in pre-filtered backlog?" [shape=diamond];
  "Matched entry is in the committed backlog and either it or the finding is Bug class: Security?" [shape=diamond];

  "In-scope" [shape=box, style=bold];
  "Out-of-scope (bug)" [shape=box, style=bold];
  "Out-of-Scope Addition" [shape=box, style=bold];
  "Emit update directive: last_seen, written back to the entry's source file at write time" [shape=box];
  "Mint new backlog entry" [shape=box];
  "Emit migrate directive: copy into paad/security/backlog.md under the same ID at write time, leave the committed file alone" [shape=box];
  "Bug class: Security (set by the Verifier)?" [shape=diamond];
  "Write to paad/security/ report (and backlog, for out-of-scope bugs); count-and-pointer line in the main report" [shape=box, style=bold];
  "paad/security/.gitignore holds only * and git tracks nothing there?" [shape=diamond];
  "Write nothing under paad/security/; tell the user, ask: hold or ordinary report" [shape=box];
  "Write to paad/code-reviews/ report (and backlog, for out-of-scope bugs)" [shape=box];

  "Finding from specialist (verified)" -> "Carries [OOSA] sentinel or category: out-of-scope-addition tag?";
  "Carries [OOSA] sentinel or category: out-of-scope-addition tag?" -> "Out-of-Scope Addition" [label="yes (Spec Compliance)"];
  "Out-of-Scope Addition" -> "Bug class: Security (set by the Verifier)?";
  "Carries [OOSA] sentinel or category: out-of-scope-addition tag?" -> "Anchor line in touched-lines map?" [label="no"];
  "Anchor line in touched-lines map?" -> "Touch is purely cosmetic AND bug is purely pre-existing?" [label="yes"];
  "Anchor line in touched-lines map?" -> "Branch causes/worsens this bug?" [label="no"];
  "Touch is purely cosmetic AND bug is purely pre-existing?" -> "Out-of-scope (bug)" [label="yes (demote)"];
  "Touch is purely cosmetic AND bug is purely pre-existing?" -> "In-scope" [label="no"];
  "Branch causes/worsens this bug?" -> "In-scope" [label="yes (promote)"];
  "Branch causes/worsens this bug?" -> "Out-of-scope (bug)" [label="no"];
  "Out-of-scope (bug)" -> "Match in pre-filtered backlog?";
  "Match in pre-filtered backlog?" -> "Matched entry is in the committed backlog and either it or the finding is Bug class: Security?" [label="yes"];
  "Matched entry is in the committed backlog and either it or the finding is Bug class: Security?" -> "Emit migrate directive: copy into paad/security/backlog.md under the same ID at write time, leave the committed file alone" [label="yes"];
  "Matched entry is in the committed backlog and either it or the finding is Bug class: Security?" -> "Emit update directive: last_seen, written back to the entry's source file at write time" [label="no"];
  "Emit migrate directive: copy into paad/security/backlog.md under the same ID at write time, leave the committed file alone" -> "paad/security/.gitignore holds only * and git