specialist-review

Specialist-Review — Context-Aware Code Review

Standalone context-aware code review with specialist lens routing. Core principle: Match the lens to the risk. Auth code → STRIDE. Async code → TEMPORAL.

---

When to Request Review

Mandatory: after each task in subagent-driven development, after major feature, before merge. Optional: when stuck, before refactoring, after complex bug fix.

---

Alternative Entry: Role-Based Dispatch

Nếu lens signals không rõ hoặc requester nghĩ theo roles thay vì technical lenses:

"Tôi cần..."	Primary Lens	Key focus
Security architect review	STRIDE + OWASP	Trust boundaries, injection, auth lifecycle
Systems architect review	ATAM + CPT	Quality tradeoffs, write chains, scale assumptions
Async engineer review	TEMPORAL	Commit boundaries, idempotency, worker safety
Domain expert review	CONTEXT.md grounding	Vocabulary alignment, spec-to-code drift
Generic code review	No signal → generic	Spec compliance + code quality

Role dispatch routes to the same VHEATM lenses — it's a UX alias, not a different methodology.

Step 1: Detect Signals

Scan the diff and changed file paths:

STRIDE triggers (auth / trust boundary):
  imports:  jwt, oauth2, session, bcrypt, crypto, hmac, passport, authlib, PyJWT
  paths:    auth/, middleware/, guard/, interceptor/, policy/
  patterns: "token", "permission", "role", "scope", "principal", "authenticate"

OWASP triggers (user input / web surface):
  imports:  request, express, fastapi, flask, axios, fetch, httpx, aiohttp
  patterns: user-controlled params entering DB queries, HTML rendering, file paths
  paths:    routes/, controllers/, api/, handlers/, views/

ATAM triggers (architecture decision):
  files:    docs/superskills/adrs/, docs/architecture/
  patterns: "service", "gateway", "queue", "cache", "broker", "consensus"
  scope:    diff touches > 3 services or crosses module boundaries

TEMPORAL triggers (async / state / time):
  imports:  asyncio, celery, arq, dramatiq, threading, concurrent.futures,
            SQLAlchemy (async), asyncpg, aioredis
  patterns: "await", "async def", "background_task", "worker", "retry", "cron"
  paths:    workers/, jobs/, tasks/, background/, queues/

CPT triggers (write chain / interface boundary):
  patterns: write chain ≥ 3 components (A → B → C with shared state)
  signals:  financial path, payment processing, data pipeline, audit trail

PRIVACY/SECRETS triggers (sensitive data / disclosure):
  patterns: PII, secret, token, api_key, private_key, payment, regulated, telemetry, logging, prompt/tool payload, export, backup
  paths:    logging/, telemetry/, analytics/, ai/, prompts/, exports/, backups/, billing/, payments/
  action:   run `privacy-secrets-gate`; treat this as a release blocker if C4 or external disclosure is planned