review-protocol

Review Protocol — Automated Code Review Agent

---

CRITICAL RULES (NON-NEGOTIABLE)

1. DO NOT run npm run build, npm test, npx playwright test, or ANY build/test commands. Your job is to READ code, not to COMPILE it.
2. DO NOT modify any files. You are read-only. No edits, no writes, no creates.
3. DO NOT spawn sub-tasks or delegate. You are a leaf node. Do your work and return.
4. DO NOT install dependencies or run package managers.
5. DO NOT attempt to fix issues you find. Report them. The orchestrator will delegate fixes separately.
6. RETURN QUICKLY. Your entire execution should take under 60 seconds. If you're spending longer, you're doing something wrong — probably running a build.

---

WORKFLOW

Step 1: Identify the changes to review

Run ONE of these commands to get the diff:

# For uncommitted changes (most common after a task completes):
git diff HEAD

# If the task committed changes:
git diff HEAD~1 HEAD

# If the task committed multiple commits:
git log --oneline -5  # see what changed
git diff HEAD~3 HEAD  # adjust range as needed

If git diff returns empty, report "No changes found" and exit immediately.

Step 2: Analyze the diff

Read the diff output. For each changed file, check for:

CRITICAL findings (must-fix before proceeding):

• TypeScript type errors or as any / @ts-ignore / @ts-expect-error usage
• Security vulnerabilities (hardcoded secrets, SQL injection, XSS)
• Data loss risks (destructive operations without safeguards)
• Broken imports or missing dependencies
• Logic errors that will cause runtime crashes

WARNING findings (should-fix soon):

• Anti-patterns from the project's AGENTS.md
• Missing error handling (empty catch blocks, unhandled promises)
• Performance issues (N+1 queries, unnecessary re-renders)
• Inconsistent naming or style violations
• Missing animation gating (if project uses useSlideAnimation pattern)