code-review

Code Review

Use this skill from Claude, Codex, OpenCode, or another compatible agent to obtain an independent, attributable review or adversarial challenge. The job is not to delegate implementation. The caller supplies the model family that produced the candidate so the router can exclude same-family reviewers.

Modes

Choose the smallest useful mode:

• Review mode: normal pre-merge or plan review. Find blocking or materially misleading issues.
• Challenge mode: adversarial pass modeled after codex challenge. Try to break the diff or decision by finding production failure paths.
• Complete mode: local exact-candidate deep-self-review checkpoint after a passed final round. It invokes no reviewer and grants no human or merge authority.
• Consult mode: ask Claude a bounded question when no diff or plan review is needed.

Use challenge mode when the user asks for "challenge", "poke holes", "try to break it", "adversarial", or when the change touches money, permissions, privacy, compliance, tenant/user data, production rollout, high-impact AI, architecture, economics, or IA.

Script Entry Point

For gate-eligible review and challenge, use scripts/review_gate.sh. --review-plan-file is optional for review and challenge: supply a four-field plan (intent, acceptance, self_review, evidence) to bind implementer-authored scope and per-owner self-review, or omit it to run under a derived default. The result records review_plan_source=implementer-supplied or review_plan_source=derived-default so a ceremony-free review is never mistaken for a hand-attested one; complete mode still requires an explicit plan. The gate derives stage concerns, freezes candidate/profile plus stable review-context/controller/skill/history hashes, and validates any self_review[*].skill against the complete sibling skill registry. Omit skill to use the code-review baseline. The controller also derives owners from changed skills/<name>/ paths, test paths, and supported source extensions. With an implementer-supplied plan every derived owner must appear in structured self-review before a provider runs; a derived-default plan still selects and loads those owners for the reviewer but waives the pre-attestation requirement it has no plan to check. The frozen selected set contains the baseline plus every declared or derived owner; each binding hashes SKILL.md and recursive Markdown under references/, not scripts, templates, or other files. Unknown or linked owner packages fail before provider execution. Supported installs ship the complete skills/ registry; an isolated copy can use only the baseline unless its sibling owners are also present. Stable results expose deterministic routing evidence and report owner_selection_source=controller-derived+implementer-declared whenever path-derived owners participate. The gate passes only selected owner names, the canonical registry root, and frozen hashes to wrappers. It never copies skill bodies or selected references into the review packet. Claude, Kimi, OpenCode, and Codex activate those installed skills through their native mechanisms. After a valid wrapper verdict, reviewed_skills records only the owner names actually passed through native invocation; the general code-review baseline stays in selected_skills and is not counted as natively invoked. skill_usage_evidence distinguishes that native explicit invocation from observed_skill_usage; the latter stays empty unless a public client event/export proves activation. Reviewer prose and private client databases are not accepted as proof. A client that cannot provide the native binding is ineligible and may fall through under the existing egress rules. The gate excludes same-family reviewers and stops on boundary failures. Default order is claude,codex,kimi,opencode; local CODE_REVIEW_CLIENT_ORDER may narrow/reorder it. Non-Claude egress is gated by a secret-scan tripwire, not a blanket approval: the frozen packet is scanned for high-signal credential material, and a clean packet may egress to a non-Claude reviewer automatically while a scan hit is skipped egress_denied unless --allow-fallback-egress approves it. The result's egress.secret_scan lists the categories hit (empty when clean). The scan is machine-detectable credentials only; broad semantic confidentiality stays operator-owned per the Diff Confidentiality section. Consult stays on claude_review.sh. Load the staged-contract and client-routing references below for details.