review

/review — Unified Review Gate

Announce: open your reply with "Using /review [mode] …".

Token budget

• Diff-first always. git diff --stat then targeted git diff <files> — never the whole repo. Screenshot routes lazily (only when you reach a route).
• Reviewer subagents get the diff + spec, not the whole repo. Capture smoke output verbatim; re-Read only the failing tail. Don't re-Read root CLAUDE.md.

Mode dispatch

/review               → AUTO-SELECT (§1)
/review design        → 3-lens visual-fidelity gate (§2)
/review security      → semantic security pass (§3)
/review gates <ID>    → 6-gate post-delegation review (§4)
/review ultra [<base>]→ Workflow-backed adversarial review, large diffs (§5)

---

§1 — AUTO-SELECT

Scope the diff, then fire the matching lens(es). State which triggered and why; if none trigger, say so and stop — do NOT manufacture findings.

git diff --stat <integration-base>...HEAD
git diff <integration-base>...HEAD

• Phase 9 → design lens (§2): diff touches UI component / page / layout; design tokens / theme / CSS variables; i18n catalogs; responsive breakpoints; animations / motion; focus / hover / a11y-visible styling.
• Phase 7 → security lens (§3): auth / session / token; password / credential; crypto; SQL / query building; HTML rendering of untrusted input; file-path / archive extraction; shell / subprocess spawning; deserialization; secret files; new external endpoints; SSRF; XXE; prototype pollution; CORS / CSP / cookies; regex from user input (ReDoS); committed agent-config (.claude/settings*.json, .mcp.json, .claude/hooks/*, ANTHROPIC_BASE_URL); any new dependency in a manifest.
• Neither → quality lens: run the Gate 4b reviewers on the diff (see §4).

Canonical trigger definitions: ../../rules/phase-matrix.md. Multiple triggers → run multiple lenses (design → security → quality).

---

§2 — DESIGN lens (/review design)