codereview

CodeReview Investigation Workflow

Conduct a systematic, multi-step code review of the specified files using the CodeReview methodology. This approach prevents superficial single-pass reviews by enforcing multiple investigation steps with progressive confidence building.

Files to review and focus: $ARGUMENTS

Code Review Framework

Severity Classification

Use this framework to classify every issue found:

• 🔴 CRITICAL - Security vulnerabilities, crashes, data loss, data corruption
• 🟠 HIGH - Logic errors, reliability problems, significant bugs
• 🟡 MEDIUM - Code smells, maintainability issues, technical debt
• 🟢 LOW - Style issues, minor improvements, documentation gaps

Confidence Levels

Track your confidence explicitly at each step using the TodoWrite tool. Progress through these levels as evidence accumulates:

• exploring - Initial code scan, forming hypotheses about issues
• low - Basic patterns identified, many areas unchecked
• medium - Core issues found, edge cases need validation
• high - Comprehensive coverage, findings validated
• very_high - Exhaustive review, minor gaps only
• almost_certain - All code paths checked
• certain - Complete confidence, no further investigation needed

Investigation State

Maintain this state structure throughout the code review:

{
  "step_number": 2,
  "confidence": "medium",
  "findings": [
    "Step 1: Found SQL injection vulnerability in auth.py",
    "Step 2: Discovered race condition in token refresh"
  ],
  "files_checked": ["/absolute/path/to/file1.py", "/absolute/path/to/file2.py"],
  "issues_found": [
    {
      "severity": "critical",
      "description": "SQL injection in user query construction",
      "location": "auth.py:45",
      "impact": "Attackers can execute arbitrary SQL commands"
    }
  ]
}

Workflow Steps

Step 1: Initial Code Scan (Confidence: exploring)

Focus on:

• Reading specified code files completely
• Understanding structure, architecture, design patterns
• Identifying obvious issues (bugs, security vulnerabilities, performance problems)
• Noting code smells and anti-patterns
• Looking for common vulnerability patterns