branch-review

name: branch-review description: Review a branch before merge [target] [level] argument-hint: [file, branch (e.g. main), range (main..HEAD), or empty] [effort level] allowed-tools: Read, Grep, Glob, Agent, Bash(git diff:), Bash(git log:), Bash(git show:), Bash(git status:), Bash(git grep:), Bash(git rev-parse:), Bash(git merge-base:), Bash(rg:) disable-model-invocation: true

Pre-merge review gate. Two stages — general review then a full security audit — followed by an adversarial verify pass. It never edits code: it reports findings and hands them back. Fixing is a separate, separately authorized action.

Only Critical and High findings block the merge. Everything else is appended to the fix ledger (.amp/remember/fix-ledger.md) — a local, cumulative list, living beside MEMORY.md, that /refactor (no arguments) works through between features. Like its neighbours it is a private working artifact, usually gitignored; it persists across reviews, it is not a deliverable. The report is blockers plus the ledger count, so a review converges instead of surfacing fresh nits every run. This command never runs /refactor itself — it nudges, the way /stash nudges /remember.

Run this before /release. /release will refuse to run without a review at the current HEAD SHA.

Guardrails

• Spawn a worker and explicitly select your tool's mid tier. State the tier on the spawn — do not omit it and rely on a default. An omitted tier inherits the parent's tier, which is not the same thing as the balanced one. Pick the judgment-capable tier that is cheaper and faster than your top reasoning tier. Not the cheapest/fastest tier: on judgment work it measurably degrades (misclassification rates several times higher). Choose by tier, not by a vendor model name copied from this file — names drift, and this command ships to several tools. Fall back to running inline if your tool has no subagent mechanism.
• Escalate, never assume. Anything you cannot decide, cannot verify, or that this spec does not cover → stop and report it to the orchestrator (the main session). Never improvise, never widen scope, never fix a side issue you noticed along the way.
• The worker does the work itself — no delegation. The review subagent must not spawn subagents of its own. Everything it reports has to be something it read, ran, or grepped with its own tool calls: a relayed "I executed X" from a sub-worker is hearsay, and replacing hearsay with evidence is the entire point of this command. A review that delegates its work is a review of a report. (Same rule /security carries inside stage 2.)
• No edits — two exceptions. You have no authorization to change code, even for a finding you are certain about. Report it. The only files you may write are .amp/remember/fix-ledger.md (append bullets; never rewrite or delete) and .amp/remember/last-review.md (overwrite; the review record described at the end of this file).
• Prove it with two checks, because neither sees what the other does. git status --porcelain, at start and again before you report, proves no tracked file changed — that is the "never edits code" guarantee, and it is the one that matters. It cannot police your own two writes: .amp/ is normally gitignored, so porcelain stays empty whether you wrote the allowed files, wrote nothing, or overwrote MEMORY.md. git status --ignored does not close it either — it collapses to !! .amp/, the directory, not the files. So also take md5sum .amp/remember/* before you start and again before you report, and show the comparison: only fix-ledger.md and last-review.md may differ.