concurrency-review

Concurrency Review

Scope: always Cites: [adversarial-review-protocol]

Output JSON: per ${CLAUDE_PLUGIN_ROOT}/knowledge/review-agent-output-contract.md (Whole-file load: short, canonical schema).

Status: pass=no concurrency issues, warn=potential concerns, fail=likely race conditions or safety violations Severity: error=race condition or data corruption risk, warning=potential concurrency concern, suggestion=defensive improvement Confidence: high=mechanical pattern fix (add await, add finally); medium=fix direction clear but requires understanding shared state; none=requires human judgment (architectural concurrency design)

Context needs: full-file

Skip

Return {"status": "skip", "issues": [], "summary": "No concurrency-relevant patterns in target"} when:

• No concurrency-relevant patterns present:
  • JS/TS: no async/await, Promise, Worker, or SharedArrayBuffer
  • C#: no async/await, Task, Thread, Parallel, lock, or ConcurrentCollection
  • Java: no Thread, ExecutorService, CompletableFuture, synchronized, volatile, or java.util.concurrent
• No shared mutable state across callbacks, event handlers, or concurrent paths
• Pure synchronous single-threaded code with no event-driven patterns

Detect

Race conditions:

• Read-then-write without atomicity (check-then-act)
• Shared mutable state accessed from multiple async paths
• Event handlers modifying shared state without guards
• Database read-modify-write without transactions or optimistic locking
• File operations without locking (open-write-close races)

Idempotency:

• Non-idempotent HTTP handlers (POST/PUT without deduplication)
• Side effects in retry-able operations (payments, emails, queue messages)
• Missing idempotency keys on critical mutations

Async/concurrent task pitfalls:

• Unhandled rejections/exceptions:
  • JS/TS: missing .catch() or try/catch on await
  • C#: unawaited Task with no .ContinueWith error handler; async void methods
  • Java: unhandled CompletableFuture without .exceptionally() or .handle()
• Dangling async operations (fire-and-forget without intent):
  • JS/TS: async calls without await
  • C#: Task not awaited and not stored
  • Java: CompletableFuture not awaited and not stored
• Parallel task failures swallowing errors:
  • JS/TS: Promise.all — one rejection cancels all without individual error handling
  • C#: Task.WhenAll — exceptions from individual tasks swallowed unless explicitly checked
  • Java: CompletableFuture.allOf — individual failures require explicit .exceptionally() per stage
• Sequential operations that could be parallel:
  • JS/TS: sequential await calls with no dependency between them (use Promise.all)
  • C#: sequential await calls with no dependency (use Task.WhenAll)
  • Java: sequential get() calls with no dependency (use CompletableFuture.allOf)
• Iteration not awaited:
  • JS/TS: async callback in forEach (does not await iterations; use for...of)
  • C#: async lambda in List.ForEach (fire-and-forget; use foreach + await)
  • Java: async-like operations inside stream().forEach without joining