reviewer-checklist

A review checklist for an agent that checks another agent’s software work against requirements, tests, project rules, and related modules.

In plain words
What is it for?
Use it to review completed coding tasks for behavior, test-driven development (writing tests around required behavior), code quality, and consistency across modules.
Why use it?
It helps catch missing requirements, weak or misleading tests, unapproved dependencies, and code that drifts from the agreed plan.

Agent

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add agents/matthewye/opencode-toolbox/reviewer-checklist
Clone the repo
git clone --depth 1 https://github.com/MatthewYe/opencode-toolbox
Per session 0 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 1,194 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00000 $0.01194
Opus 5 $0.00000 $0.00597
Sonnet 5 $0.00000 $0.00239
Haiku 4.5 $0.00000 $0.00119

Measured 3d ago against content hash 17d96f60309e, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

reviewer-checklist scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

docs/agents/reviewer-checklist.md · 77 lines

How it starts

The opening of the file, as written. The whole thing — 77 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Reviewer Checklist

Autopilot issue 审查标准。reviewer agent 按此清单逐项检查 implementer 的产出。

维度一:Behavior 对齐

对照 AGENT-BRIEF.md 的 Acceptance Criteria,逐条验证:

  • 每条 AC 是否有对应的测试覆盖?
  • 测试是否覆盖了 AC 中描述的 edge cases 和 error conditions?
  • 是否存在 scope creep — 实现了 AGENT-BRIEF Out of scope 里列出的内容?
  • 是否存在 scope gap — 漏掉了某条 AC 或只部分实现?

维度二:TDD 纪律

参考 tdd 技能中的测试质量标准:

  • 是否存在没有对应 failing test 的生产代码?
  • 测试是否通过公共接口验证行为,而非测试内部实现细节?
  • 是否 mock 了内部模块/自己控制的类?
  • Mock 是否仅在系统边界(外部 API、DB、时间、文件系统)?
  • 是否能区分 "通过测试" 和 "测试正确"(假绿色)?

维度三:代码质量

对照项目 CONTEXT.md 和 docs/adr/:

  • 命名是否使用项目领域词汇(CONTEXT.md)?
  • 新代码是否遵循项目已有模式,而非引入新风格?
  • 接口是否小、是否可测试(接口即测试面)?
  • 是否引入了未在 AGENT-BRIEF 中声明的依赖?
  • 是否与现有 ADRs 冲突?

维度四:计划忠实度与跨模块一致性

此维度确保实现不仅"看起来能跑",而且"就是计划要的东西"——没有偏离约束,没有混入计划外内容,且与同一批任务中的兄弟模块保持一致的工程纪律。

4a. 计划忠实度

对照合约和所有上层计划文档(PRD、ADR),检查:

  • 实现是否满足计划中声明的全局约束(非单条 AC,而是 PRD/ADR 级别的战略决策)?例如:输出格式要求(byte-identical、结构等价)、运行时约束、依赖白名单
  • 是否存在约束降级 — 计划要求 A 但实现只做了 A'(如要求 byte-identical 但仅做了结构等价)?
  • 是否引入了计划白名单外的依赖(package.json、import 语句)?
  • 文件是否放在了计划指定的位置,而非自创目录?

4b. 跨模块一致性

当任务是同一批/同一计划下的多个模块之一时,对照已完成的兄弟模块检查:

  • 工程约定是否一致 — 入口检测方式、import 风格(静态/动态)、错误处理模式、日志格式?
  • 算法选择是否一致 — PRNG 实现、日期格式化、编码方式?同一批任务应使用相同的底层实现
  • 文件布局是否一致 — 测试目录名、fixture 路径约定、CLI 入口结构?

Why:一个模块选了 mulberry32 PRNG、另一个模块用了 Mersenne Twister,单独看都可以通过 AC,但合在一起是不一致的工程债务。这种债务单体审查发现不了,必须对照兄弟模块。

4c. 计划外变更检测

  • 是否有不在任何合约中的新文件(孤儿脚本、未声明的测试文件、临时文件)?
  • 是否有合约/计划明说要删除但尚未删除的文件(如迁移计划中 Python 脚本、旧配置文件)?
  • 是否引入了合约未声明的新行为(如悄悄加了 UX 优化、额外校验、额外日志)?
  • 是否有未在合约中声明的副作用(自动创建目录、修改全局配置、静默改写其他模块的文件)?

分级指南

级别 标准 示例
Critical 不可交付,必须本轮修复:漏掉 AC、无测试生产代码、方向性错误、违反计划全局约束(byte-identical 降级为近似)、兄弟模块间算法不一致 实现了 A 但 AGENT-BRIEF 要求的是 B;PRD 要求 byte-identical 但仅做了结构等价且未说明
Important 不可交付,必须本轮修复:工程约定不一致、孤儿文件、未声明依赖、计划要求删除但保留的文件、跨模块模式漂移 3 个模块用 import.meta.main,第 4 个用 process.argv[1]
Suggestion 可忽略:风格建议、可选优化 可以考虑提取工具函数减少重复

Read the full file on GitHub · 77 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 3d ago First seen · 77 lines · 0 tokens per session scan A 17d96f60309e

Subscribe to this mod's changes

reviewer-checklist is an agent published in the GitHub repository MatthewYe/opencode-toolbox (5 stars, last pushed 2mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,194 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.