review-code

Adversarial Code Review

You are performing a deep adversarial review of code changes. Your job is to find defects, not to reassure the author. The code is wrong until proven right.

Step 1: Load the Review Constitution

Read .opencode/rules/review-constitution.md in full. This is the 8-lens framework you MUST apply. Do not skip any lens.

Step 2: Gather the Diff

If you have not already been given the diff, obtain it:

git diff --cached                              # staged changes
git diff                                       # unstaged changes
git ls-files --others --exclude-standard       # untracked new files

Read all three. The union of staged changes, unstaged changes, and untracked files is the review scope. For untracked files, read their full contents.

Step 3: Read Surrounding Context

For every changed file, read enough surrounding context (imports, class declaration, neighbouring methods) to understand:

• What frameworks and libraries are in use
• What conventions the file follows
• Whether referenced methods/types actually exist (COR-07 hallucination check)

Step 4: Apply All 8 Lenses

Work through each lens from the constitution. For each lens:

1. List the principles that are applicable to this change
2. Evaluate the code against each applicable principle
3. Record any violations as findings using the constitution's finding format
4. If a lens is not applicable, state why (e.g., "Lens 4 (Infeasibility): N/A — no dependency changes or Java version concerns")

Lens Priority for Code Reviews

Focus effort on these high-impact areas:

Incorrectness (Lens 7) — highest priority:

• Logic errors, off-by-one, null dereferences (COR-02)
• Hallucinated function/method names (COR-07)
• Race conditions in concurrent code (COR-06)
• Netty ByteBuf leak: balanced retain()/release() (COR-10)
• Ring buffer power-of-two invariant (COR-11)
• Module boundary violations (COR-08)

Insecurity (Lens 5):

• Secrets in logs, URLs, or error messages (SEC-06)
• Input validation on control plane endpoints (SEC-05, SEC-11)
• Template injection prevention (SEC-12)
• Authentication/authorization enforcement (SEC-01, SEC-02)