reviewing

Reviewing Skill

This skill defines the two-pass review workflow that validates implementation quality before a task is marked complete. It is dispatched after a task is implemented and tests pass (at depth >= standard).

Inputs

You will receive:

• Implemented code: The files created or modified by the executor for this task
• Spec requirements: The R-numbered requirements and acceptance criteria this task must satisfy
• Task definition: From the frontier file, including task name, dependencies, and repo
• Review iteration: Which review pass this is (1, 2, or 3)

Two-Pass Review Workflow

Pass 1: Spec Compliance Review (mandatory for depth >= standard)

This is the primary review pass. It verifies that the implementation actually satisfies the spec.

Procedure:

1. Read the actual code. Do NOT trust the implementer's report or summary. Open every file that was created or modified and read it.
2. List every acceptance criterion from the spec requirements assigned to this task.
3. Check each criterion against the code:
   • Is there code that implements this criterion?
   • Does the implementation match what the criterion specifies (not just approximate it)?
   • Is the criterion fully satisfied, or only partially?
4. Flag missing implementations — acceptance criteria with no corresponding code.
5. Flag extra features — code that goes beyond what the spec requires. Over-engineering wastes tokens and introduces unnecessary complexity. If the spec says "return 201 with {id, email}", the code should not also return created_at, updated_at, and role unless the spec asks for them.
6. Flag misunderstandings — code that implements something different from what the criterion describes. Example: spec says "hash with bcrypt (min 12 rounds)" but code uses SHA-256.

Output for Pass 1:

## Spec Compliance

STATUS: PASS | ISSUES

CHECKED CRITERIA:
- [x] R001/AC1: POST /auth/register accepts {email, password} — implemented in src/controllers/auth.ts:45
- [ ] R001/AC2: Password hashed with bcrypt (min 12 rounds) — MISSING, no hashing found
- [x] R001/AC3: Returns 201 with JWT + refresh token — implemented in src/controllers/auth.ts:67

ISSUES (if any):
- [CRITICAL] src/controllers/auth.ts — R001/AC2: No password hashing implemented. Raw password stored directly.
- [IMPORTANT] src/controllers/auth.ts:67 — Returns extra fields (created_at, role) not in spec. Over-engineering.