deep-review

<Use_When>

• User wants thorough multi-perspective code review: /deep-review, --deep
• PR or changeset is large (10+ files) and benefits from specialized analysis
• Changes touch security-sensitive code (auth, payments, API endpoints)
• User wants false-positive filtering on review findings </Use_When>

<Do_Not_Use_When>

• Quick review of a small change (1-3 files) — use code-reviewer agent directly
• User only wants security-specific review — use security-reviewer agent directly
• User wants a style-only review — use code-reviewer with model=haiku </Do_Not_Use_When>

<Why_This_Exists> Single-pass code reviews often miss issues or produce false positives because one reviewer tries to cover all concerns (security, quality, architecture) simultaneously. Deep Review separates concerns into specialized passes where each reviewer focuses on their domain, then adds a validation pass that filters false positives — producing higher-quality, actionable findings. </Why_This_Exists>

<Execution_Policy>

• Passes 1-3 MUST run in parallel (independent concerns)
• Pass 4 runs sequentially after passes 1-3 complete (depends on their output)
• Each pass uses the appropriate specialist agent
• Findings include validationStatus after pass 4
• Output is a consolidated markdown report </Execution_Policy>

1. Pass 1 - Security (parallel): Spawn security-reviewer agent

   Task(subagent_type="oh-my-copilot:security-reviewer", model="sonnet", name="security-pass", prompt="
   SECURITY REVIEW PASS for deep-review.
   Review the following changes for security vulnerabilities:
   - OWASP Top 10 categories
   - Hardcoded secrets
   - Injection vulnerabilities (SQL, XSS, command injection)
   - Authentication/authorization issues
   - Input validation gaps
   
   Output each finding as:
   FINDING:
   - severity: CRITICAL|HIGH|MEDIUM|LOW
   - category: security
   - subcategory: [OWASP category]
   - file: [file:line]
   - title: [brief title]
   - description: [detailed description]
   - suggestedFix: [how to fix]
   END_FINDING
   
   Scope: [insert scope/diff here]
   ")
   

2. Pass 2 - Quality (parallel): Spawn code-reviewer agent

   Task(subagent_type="oh-my-copilot:code-reviewer", model="sonnet", name="quality-pass", prompt="
   QUALITY REVIEW PASS for deep-review.
   Review the following changes for code quality:
   - Logic defects (off-by-one, null handling, unreachable branches)
   - Error handling completeness
   - Performance issues (N+1 queries, O(n²) algorithms)
   - Anti-patterns and SOLID violations
   - Code duplication
   
   Output each finding as:
   FINDING:
   - severity: CRITICAL|HIGH|MEDIUM|LOW
   - category: quality
   - subcategory: [logic|error-handling|performance|anti-pattern|duplication]
   - file: [file:line]
   - title: [brief title]
   - description: [detailed description]
   - suggestedFix: [how to fix]
   END_FINDING
   
   Scope: [insert scope/diff here]
   ")
   

3. Pass 3 - Structural (parallel): Spawn architect agent

   Task(subagent_type="oh-my-copilot:architect", model="sonnet", name="structural-pass", prompt="
   STRUCTURAL REVIEW PASS for deep-review.
   Review the following changes for architectural concerns:
   - API contract changes (breaking changes, versioning)
   - Backward compatibility
   - Coupling and cohesion issues
   - Abstraction leaks
   - Module boundary violations
   - Dependency direction violations
   
   Output each finding as:
   FINDING:
   - severity: CRITICAL|HIGH|MEDIUM|LOW
   - category: structural
   - subcategory: [api-contract|compatibility|coupling|abstraction|boundary|dependency]
   - file: [file:line]
   - title: [brief title]
   - description: [detailed description]
   - suggestedFix: [how to fix]
   END_FINDING
   
   Scope: [insert scope/diff here]
   ")