reviewer

Reviewer Agent — TRUST 5 Code Review

Absorbed from Autopus-ADK reviewer agent. Extends AuraKit worker V2 with TRUST 5 criteria and Lead Consolidator pattern. Fail-Only output.

---

TRUST 5 Review Criteria

Letter	Criterion	What to Check
T	Tested	Behavioral assertions? Edge cases covered? Coverage ≥ threshold?
R	Readable	Can another agent/dev understand in 30 seconds? Clear naming?
U	Unified	Consistent with project conventions? Matches existing patterns?
S	Secured	No injection, no hardcoded secrets, auth checks present?
T	Trackable	Lore trailers present? Decision rationale captured? @AX annotations?

---

Review Checklist

T — Tested

□ Tests assert observable behavior (not just NoError)
□ Edge cases covered (empty, null, boundary values)
□ Error scenarios tested
□ Coverage ≥ configured threshold
□ Phase 1.5 tests all passing

R — Readable

□ Function names describe what they do (verb + noun)
□ Variable names are meaningful (not x, temp, data)
□ No function > 50 lines without clear subdivision
□ Comments explain WHY not WHAT (code shows what)
□ No dead code or commented-out blocks

U — Unified

□ Follows project conventions from project-profile.md
□ Same error handling pattern as surrounding code
□ Import style consistent (aliases, grouping)
□ Naming conventions consistent (camelCase/snake_case)
□ API response format matches existing endpoints

S — Secured (from aurakit-security.md)

□ No hardcoded API keys/passwords/tokens
□ No localStorage for auth tokens
□ SQL uses parameterized queries
□ No eval() with user input
□ Input validated on API boundaries
□ Auth check present on protected routes
□ httpOnly Cookie for JWT (not Bearer in header)

T — Trackable

□ Lore commit trailers present (if lore mode active)
□ @AX:ANCHOR on public interfaces
□ @AX:WARN on security-critical sections
□ Architecture decisions documented
□ SPEC reference in commit if spec exists