fanout-review

Code review (multi-perspective)

Review the current branch by dispatching 6 parallel review tasks (one mandate each), then synthesize findings into a categorical merge-gate decision (🚫 BLOCK / ⚠️ NEEDS DISCUSSION / ✅ CLEAR) backed by a risk profile and deterministic blocker checks. Output is designed to paste directly into a PR thread (GitHub, GitLab, or Azure DevOps).

Mode detection

Read the user's invocation prompt:

• Contains quick, shallow, or fast → single-pass mode (skip fanout, lean output)
• Diff size below ~50 lines AND mode not explicitly stated → ask the user once whether to do single-pass; default to single-pass if unanswered
• Otherwise → fanout mode (default)

Scope detection

Read the user's invocation prompt:

• Mentions committed, this branch, PR, or main..HEAD → scope to committed changes only (git diff main..HEAD)
• Mentions staged → scope to git diff --cached
• Otherwise → include all changes (committed + staged + unstaged)

Base branch resolution, in order:

1. If the user's prompt names a branch (vs feat/X, against develop), use it.
2. Else git symbolic-ref refs/remotes/origin/HEAD if it resolves.
3. Else main if it exists locally, else master.
4. If neither exists, stop and ask the user which base to diff against. Do not silently fall back to HEAD~1.

---

Fanout mode

Step 1 — Gather diff context

Run (substitute scope from detection above):

git diff <scope> --stat
git diff <scope> --name-status
git log <scope> --no-merges --pretty=format:'%h %s'

Step 2 — Dispatch 6 review tasks in parallel

Use the Agent tool with subagent_type: general-purpose. Send all 6 in a single message with 6 tool calls so they run concurrently. Each subagent receives the diff context, one task description below, and the JSON return contract.

Task descriptions (each subagent receives exactly one):

• security — Find OWASP Top 10 violations, secrets in code, input-validation gaps, authz/authn gaps, injection (SQL/cmd/path), unsafe deserialization, and weak crypto. Use category: "security" in the return.
• performance — Find hotspots, N+1 queries, unnecessary work in loops, allocation pressure, blocking I/O on hot paths, and missing memoization. Use category: "performance".
• breaking-change — For each file in the diff, run git show <base-branch>:<path> and compare against the new version. Flag changed function signatures (added/removed/renamed params, changed return type), removed exports, schema/migration changes, env-var removals, feature-flag removals, behavior changes in public APIs, and removed config keys. Use category: "breaking-change".
• test-coverage — Find missing tests for new code paths, untested edge cases (empty/null/boundary), redundant tests, and test-quality issues (AAA, FIRST, flakiness, mocks of external deps). Use category: "test".
• readability — Find naming inconsistencies vs project conventions, unclear variable/function names, missing or excessive comments, magic numbers, and excessive function length/complexity. Use category: "readability".
• dry-solid — Find DRY violations (3+ similar implementations), SOLID violations, dead code, antipatterns, and leaky abstractions. DRY is project priority — weight findings here higher than readability. Use category: "dry-solid". When a DRY violation spans multiple files, set location to the canonical file (the natural home for the extracted abstraction, else first by path order) and list the remaining occurrences in duplicate_locations — do not concatenate multiple file:lines into one location string.