Team Review

Team Review

Orchestrate multi-agent code review: scanner -> reviewer -> fixer. Toolchain + LLM scan, deep analysis with root cause enrichment, and automated fix with rollback-on-failure.

Architecture

Skill(skill="team-review", args="task description")
                    |
         SKILL.md (this file) = Router
                    |
     +--------------+--------------+
     |                             |
  no --role flag              --role <name>
     |                             |
  Coordinator                  Worker
  roles/coordinator/role.md    roles/<name>/role.md
     |
     +-- analyze -> dispatch -> spawn workers -> STOP
                                    |
                    +-------+-------+-------+
                    v       v       v
                [scan]  [review]  [fix]
                team-worker agents, each loads roles/<role>/role.md

Role Registry

Role Router

Parse $ARGUMENTS:

• Has --role <name> -> Read roles/<name>/role.md, execute Phase 2-4
• No --role -> @roles/coordinator/role.md, execute entry router

Shared Constants

• Session prefix: RV
• Session path: .workflow/.team/RV-<slug>-<date>/
• Team name: review
• CLI tools: ccw cli --mode analysis (read-only), ccw cli --mode write (modifications)
• Message bus: mcp__ccw-tools__team_msg(session_id=<session-id>, ...)

Worker Spawn Template

Coordinator spawns workers using this template:

Agent({
  subagent_type: "team-worker",
  description: "Spawn <role> worker",
  team_name: "review",
  name: "<role>",
  run_in_background: true,
  prompt: `## Role Assignment
role: <role>
role_spec: <skill_root>/roles/<role>/role.md
session: <session-folder>
session_id: <session-id>
team_name: review
requirement: <task-description>
inner_loop: <true|false>

## Progress Milestones
session_id: <session-id>
Report progress via team_msg at natural phase boundaries (context loaded -> core work done -> verification).
Report blockers immediately via team_msg type="blocker".
Report completion via team_msg type="task_complete" after final SendMessage.

Read role_spec file (@<skill_root>/roles/<role>/role.md) to load Phase 2-4 domain instructions.
Execute built-in Phase 1 (task discovery) -> role Phase 2-4 -> built-in Phase 5 (report).`
})

User Commands

Completion Action

When pipeline completes, coordinator presents:

AskUserQuestion({
  questions: [{
    question: "Review pipeline complete. What would you like to do?",
    header: "Completion",
    multiSelect: false,
    options: [
      { label: "Archive & Clean (Recommended)", description: "Archive session, clean up team" },
      { label: "Keep Active", description: "Keep session for follow-up work" },
      { label: "Export Results", description: "Export deliverables to target directory" }
    ]
  }]
})

Session Directory

.workflow/.team/RV-<slug>-<date>/
├── .msg/messages.jsonl     # Team message bus
├── .msg/meta.json          # Session state + cross-role state
├── wisdom/                 # Cross-task knowledge
├── scan/                   # Scanner output
├── review/                 # Reviewer output
└── fix/                    # Fixer output

Specs Reference

• specs/pipelines.md — Pipeline definitions and task registry
• specs/dimensions.md — Review dimension definitions (SEC/COR/PRF/MNT)
• specs/finding-schema.json — Finding data schema
• specs/team-config.json — Team configuration

Error Handling

Analyze Task

Parse user task -> detect review capabilities -> build dependency graph -> design pipeline.

CONSTRAINT: Text-level analysis only. NO source code reading, NO codebase exploration.

Signal Detection

Pipeline Mode Detection

Dependency Graph

Natural ordering for review pipeline:

• Tier 0: scanner (toolchain + semantic scan, no upstream dependency)
• Tier 1: reviewer (deep analysis, requires scan findings)
• Tier 2: fixer (apply fixes, requires reviewed findings + user confirm)

Pipeline Definitions

quick:    SCAN(quick=true)
default:  SCAN -> REV
full:     SCAN -> REV -> [user confirm] -> FIX
fix-only: FIX

Complexity Scoring

Results: 1-2 Low, 3-4 Medium, 5+ High

Role Minimization

• Cap at 4 roles (coordinator + 3 workers)
• Sequential pipeline: scanner -> reviewer -> fixer

Output

Write <session>/task-analysis.json:

{
  "task_description": "<original>",
  "pipeline_mode": "<quick|default|full|fix-only>",
  "target": "<path>",
  "dimensions": ["sec", "cor", "prf", "mnt"],
  "auto_confirm": false,
  "capabilities": [{ "name": "<cap>", "prefix": "<PREFIX>" }],
  "dependency_graph": { "<TASK-ID>": { "role": "<role>", "blockedBy": ["..."] } },
  "roles": [{ "name": "<role>", "prefix": "<PREFIX>", "inner_loop": false }],
  "complexity": { "score": 0, "level": "Low|Medium|High" }
}

Dispatch Tasks

Create task chains from pipeline mode with proper blockedBy relationships.

Workflow

1. Read task-analysis.json -> extract pipeline_mode and parameters 2. Read specs/pipelines.md -> get task registry for selected pipeline 3. Topological sort tasks (respect blockedBy) 4. Validate all owners exist in role registry (SKILL.md) 5. For each task (in order):

• TaskCreate with structured description (see template below)
• TaskUpdate with blockedBy + owner assignment

6. Update session meta.json with pipeline.tasks_total 7. Validate chain (no orphans, no cycles, all refs valid)

Task Description Template

PURPOSE: <goal> | Success: <criteria>
TASK:
  - <step 1>
  - <step 2>
CONTEXT:
  - Session: <session-folder>
  - Target: <target>
  - Dimensions: <dimensions>
  - Upstream artifacts: <list>
EXPECTED: <artifact path> + <quality criteria>
CONSTRAINTS: <scope limits>
---
InnerLoop: <true|false>
RoleSpec: ~  or <project>/.claude/skills/team-review/roles/<role>/role.md

Pipeline Task Registry

default Mode

SCAN-001 (scanner): Multi-dimension code scan
  blockedBy: [], meta: target=<target>, dimensions=<dims>
REV-001 (reviewer): Deep finding analysis and review
  blockedBy: [SCAN-001]

full Mode

SCAN-001 (scanner): Multi-dimension code scan
  blockedBy: [], meta: target=<target>, dimensions=<dims>
REV-001 (reviewer): Deep finding analysis and review
  blockedBy: [SCAN-001]
FIX-001 (fixer): Plan and execute fixes
  blockedBy: [REV-001]

fix-only Mode

FIX-001 (fixer): Execute fixes from manifest
  blockedBy: [], meta: input=<fix-manifest>

quick Mode

SCAN-001 (scanner): Quick scan (fast mode)
  blockedBy: [], meta: target=<target>, quick=true

InnerLoop Flag Rules

• true: fixer role (iterative fix cycles)
• false: scanner, reviewer roles

Dependency Validation

• No orphan tasks (all tasks have valid owner)
• No circular dependencies
• All blockedBy references exist
• Session reference in every task description
• RoleSpec reference in every task description

Log After Creation

mcp__ccw-tools__team_msg({
  operation: "log",
  session_id: <session-id>,
  from: "coordinator",
  type: "dispatch_ready",
  data: { pipeline: "<mode>", task_count: <N>, target: "<target>" }
})

Monitor Pipeline

Event-driven pipeline coordination. Beat model: coordinator wake -> process -> spawn -> STOP.

Constants

• SPAWN_MODE: background
• ONE_STEP_PER_INVOCATION: true
• FAST_ADVANCE_AWARE: true
• WORKER_AGENT: team-worker

Handler Router

Role-Worker Map

handleCallback

Worker completed. Verify completion, check pipeline conditions, advance.

1. Parse message to identify role and task ID:

2. Check if progress update (inner loop) or final completion 3. Progress -> update session state, STOP 4. Completion -> mark task done via TaskUpdate(status="completed"), remove from active_workers 5. Check for checkpoints:

• scanner completes -> read meta.json for findings_count:
• findings_count === 0 -> delete remaining REV-/FIX- tasks -> handleComplete
• findings_count > 0 -> proceed to handleSpawnNext
• reviewer completes AND pipeline_mode === 'full':
• autoYes flag set -> write fix-manifest.json, set fix_scope='all' -> handleSpawnNext
• NO autoYes -> AskUserQuestion:

       question: "<N> findings reviewed. Proceed with fix?"
       options:
         - "Fix all": set fix_scope='all'
         - "Fix critical/high only": set fix_scope='critical,high'
         - "Skip fix": delete FIX-* tasks -> handleComplete

Write fix_scope to meta.json, write fix-manifest.json, -> handleSpawnNext

• fixer completes -> handleSpawnNext (checks for completion naturally)

6. -> handleSpawnNext

handleCheck

Read-only status report, then STOP.

Worker Progress (from message bus):

Before generating status output, read worker milestones:

const progressMsgs = mcp__ccw-tools__team_msg({
  operation: "list", session_id: sessionId, type: "progress", last: 50
})
const blockerMsgs = mcp__ccw-tools__team_msg({
  operation: "list", session_id: sessionId, type: "blocker", last: 10
})

// Aggregate latest milestone per task
const taskProgress = {}
for (const msg of (progressMsgs.result?.messages || [])) {
  const tid = msg.data?.task_id
  if (tid && (!taskProgress[tid] || msg.ts > taskProgress[tid].ts)) {
    taskProgress[tid] = { phase: msg.data.phase, pct: msg.data.progress_pct, ts: msg.ts }
  }
}

Include in status output:

• Per-worker latest milestone (phase + progress_pct) next to task status
• Active blockers section (if any blockerMsgs found)

Output:

[coordinator] Review Pipeline Status
[coordinator] Mode: <pipeline_mode>
[coordinator] Progress: <completed>/<total> (<percent>%)

[coordinator] Pipeline Graph:
  SCAN-001: <done|run|wait|deleted> <summary>
  REV-001:  <done|run|wait|deleted> <summary>
  FIX-001:  <done|run|wait|deleted> <summary>

  done=completed  >>>=running  o=pending  x=deleted

[coordinator] Active Workers: <list with elapsed time>
[coordinator] Ready to spawn: <subjects>
[coordinator] Commands: 'resume' to advance | 'check' to refresh

Then STOP.

handleResume

1. No active workers -> handleSpawnNext 2. Has active -> check each status

• completed -> mark done via TaskUpdate
• in_progress -> still running
• other -> worker failure -> reset to pending

3. Some completed -> handleSpawnNext 4. All running -> report status, STOP

handleSpawnNext

Find ready tasks, spawn workers, STOP.

1. Collect from TaskList():

• completedSubjects: status = completed
• inProgressSubjects: status = in_progress
• deletedSubjects: status = deleted
• readySubjects: status = pending AND all blockedBy in completedSubjects

2. No ready + work in progress -> report waiting, STOP 3. No ready + nothing in progress -> handleComplete 4. Has ready -> take first ready task: a. Determine role from prefix (use Role-Worker Map) b. TaskUpdate -> in_progress c. team_msg log -> task_unblocked d. Spawn team-worker:

Agent({
  subagent_type: "team-worker",
  description: "Spawn <role> worker for <subject>",
  team_name: "review",
  name: "<role>",
  run_in_background: true,
  prompt: `## Role Assignment
role: <role>
role_spec: ~  or <project>/.claude/skills/team-review/roles/<role>/role.md
session: <session-folder>
session_id: <session-id>
team_name: review
requirement: <task-description>
inner_loop: <true|false>

## Current Task
- Task ID: <task-id>
- Task: <subject>

## Progress Milestones
session_id: <session-id>
Report progress via team_msg at natural phase boundaries (context loaded -> core work done -> verification).
Report blockers immediately via team_msg type="blocker".
Report completion via team_msg type="task_complete" after final SendMessage.

Read role_spec file to load Phase 2-4 domain instructions.
Execute built-in Phase 1 (task discovery) -> role Phase 2-4 -> built-in Phase 5 (report).`
})

e. Add to active_workers 5. Update session meta.json, output summary, STOP

handleComplete

Pipeline done. Generate report and completion action.

1. All tasks completed or deleted (no pending, no in_progress) 2. Read final session state from meta.json 3. Generate pipeline summary: mode, target, findings_count, stages_completed, fix results (if applicable), deliverable paths 4. Update session: pipeline_status='complete', completed_at=<timestamp> 5. Read session.completion_action:

• interactive -> AskUserQuestion (Archive/Keep/Export)
• auto_archive -> Archive & Clean (status=completed, TeamDelete)
• auto_keep -> Keep Active (status=paused)

handleAdapt

Capability gap reported mid-pipeline.

1. Parse gap description 2. Check if existing role covers it -> redirect 3. Role count < 4 -> generate dynamic role-spec in <session>/role-specs/ 4. Create new task, spawn worker 5. Role count >= 4 -> merge or pause

Fast-Advance Reconciliation

On every coordinator wake: 1. Read team_msg entries with type="fast_advance" 2. Sync active_workers with spawned successors 3. No duplicate spawns

Phase 4: State Persistence

After every handler execution: 1. Reconcile active_workers with actual TaskList states 2. Remove entries for completed/deleted tasks 3. Write updated meta.json 4. STOP (wait for next callback)

Error Handling

Coordinator Role

Orchestrate team-review: parse target -> detect mode -> dispatch task chain -> monitor -> report.

Identity

• Name: coordinator | Tag: [coordinator]
• Responsibility: Target parsing, mode detection, task creation/dispatch, stage monitoring, result aggregation

Boundaries

MUST

• All output prefixed with [coordinator]
• Parse task description and detect pipeline mode
• Create team and spawn team-worker agents in background
• Dispatch task chain with proper dependencies
• Monitor progress via callbacks and route messages
• Maintain session state
• Execute completion action when pipeline finishes

MUST NOT

• Run analysis tools directly (semgrep, eslint, tsc, etc.)
• Modify source code files
• Perform code review or scanning directly
• Bypass worker roles
• Spawn workers with general-purpose agent (MUST use team-worker)

Command Execution Protocol

When coordinator needs to execute a specific phase: 1. Read commands/<command>.md 2. Follow the workflow defined in the command 3. Commands are inline execution guides, NOT separate agents 4. Execute synchronously, complete before proceeding

Entry Router

For callback/check/resume/adapt/complete: load @commands/monitor.md, execute handler, STOP.

Phase 0: Session Resume Check

1. Scan .workflow/.team/RV-*/.msg/meta.json for active/paused sessions 2. No sessions -> Phase 1 3. Single session -> reconcile (audit TaskList, reset in_progress->pending, rebuild team, kick first ready task) 4. Multiple -> AskUserQuestion for selection

Phase 1: Requirement Clarification

TEXT-LEVEL ONLY. No source code reading.

1. Parse arguments for explicit settings:

2. Extract parameters: target, dimensions, auto-confirm flag 3. Clarify if ambiguous (AskUserQuestion for target path) 4. Delegate to @commands/analyze.md 5. Output: task-analysis.json 6. CRITICAL: Always proceed to Phase 2, never skip team workflow

Phase 2: Create Team + Initialize Session

1. Resolve workspace paths (MUST do first):

• project_root = result of Bash({ command: "pwd" })
• skill_root = <project_root>/.claude/skills/team-review

2. Generate session ID: RV-<slug>-<date> 3. Create session folder structure (scan/, review/, fix/, wisdom/) 4. TeamCreate with team name "review" 5. Read specs/pipelines.md -> select pipeline based on mode 6. Initialize pipeline via team_msg state_update:

   mcp__ccw-tools__team_msg({
     operation: "log", session_id: "<id>", from: "coordinator",
     type: "state_update", summary: "Session initialized",
     data: {
       pipeline_mode: "<default|full|fix-only|quick>",
       pipeline_stages: ["scanner", "reviewer", "fixer"],
       team_name: "review",
       target: "<target>",
       dimensions: "<dimensions>",
       auto_confirm: "<auto_confirm>"
     }
   })

7. Write session meta.json

Phase 3: Create Task Chain

Delegate to @commands/dispatch.md: 1. Read specs/pipelines.md for selected pipeline's task registry 2. Create tasks via TaskCreate with blockedBy 3. Update session meta.json with pipeline.tasks_total

Phase 4: Spawn-and-Stop

Delegate to @commands/monitor.md#handleSpawnNext: 1. Find ready tasks (pending + blockedBy resolved) 2. Spawn team-worker agents (see SKILL.md Spawn Template) 3. Output status summary 4. STOP

Phase 5: Report + Completion Action

1. Generate summary (mode, target, findings_total, by_severity, fix_rate if applicable) 2. Execute completion action per session.completion_action:

• interactive -> AskUserQuestion (Archive/Keep/Export)
• auto_archive -> Archive & Clean
• auto_keep -> Keep Active

Error Handling

Code Fixer

Fix code based on reviewed findings. Load manifest, plan fix groups, apply with rollback-on-failure, verify. Code-generation role -- modifies source files.

Phase 2: Context & Scope Resolution

1. Extract session path, input path from task description 2. Load manifest (scope, source report path) and review report (findings with enrichment) 3. Filter fixable findings: severity in scope AND fix_strategy !== 'skip' 4. If 0 fixable -> report complete immediately 5. Detect quick path: findings <= 5 AND no cross-file dependencies 6. Detect verification tools: tsc (tsconfig.json), eslint (package.json), jest (package.json), pytest (pyproject.toml), semgrep (semgrep available) 7. Load wisdom files from <session>/wisdom/

Phase 3: Plan + Execute

3A: Plan Fixes (deterministic, no CLI)

1. Group findings by primary file 2. Merge groups with cross-file dependencies (union-find) 3. Topological sort within each group (respect fix_dependencies, append cycles at end) 4. Sort groups by max severity (critical first) 5. Determine execution path: quick_path (<=5 findings, <=1 group) or standard 6. Write <session>/fix/fix-plan.json: {plan_id, quick_path, groups[{id, files[], findings[], max_severity}], execution_order[], total_findings, total_groups}

3B: Execute Fixes

Quick path: Single code-developer agent for all findings. Standard path: One code-developer agent per group, in execution_order.

Agent prompt includes: finding list (dependency-sorted), file contents (truncated 8K), critical rules: 1. Apply each fix using Edit tool in order 2. After each fix, run related tests 3. Tests PASS -> finding is "fixed" 4. Tests FAIL -> git checkout -- {file} -> mark "failed" -> continue 5. No retry on failure. Rollback and move on 6. If finding depends on previously failed finding -> mark "skipped"

Agent returns JSON: {results:[{id, status: fixed|failed|skipped, file, error?}]} Fallback: check git diff per file if no structured output.

Write <session>/fix/execution-results.json: {fixed[], failed[], skipped[]}

Phase 4: Post-Fix Verification

1. Run available verification tools on modified files:

2. If verification fails critically -> rollback last batch 3. Write <session>/fix/verify-results.json 4. Generate <session>/fix/fix-summary.json: {fix_id, fix_date, scope, total, fixed, failed, skipped, fix_rate, verification} 5. Generate <session>/fix/fix-summary.md (human-readable) 6. Update <session>/.msg/meta.json with fix results 7. Contribute discoveries to <session>/wisdom/ files

Finding Reviewer

Deep analysis on scan findings: triage, root cause / impact / optimization enrichment via CLI fan-out, cross-correlation, and structured review report generation. Read-only -- never modifies source code.

Phase 2: Context & Triage

1. Extract session path, input path, dimensions from task description 2. Load review specs: Run ccw spec load --category review for review standards, checklists, and approval gates 3. Load scan results. If missing or empty -> report clean, complete immediately 3. Load wisdom files from <session>/wisdom/ 4. Triage findings into two buckets:

If deep_analysis empty -> skip Phase 3, go to Phase 4.

Phase 3: Deep Analysis (CLI Fan-out)

Split deep_analysis into two domain groups, run parallel CLI agents:

If either group empty -> skip that agent.

Build prompt per group requesting 6 enrichment fields per finding:

• root_cause: {description, related_findings[], is_symptom}
• impact: {scope: low/medium/high, affected_files[], blast_radius}
• optimization: {approach, alternative, tradeoff}
• fix_strategy: minimal / refactor / skip
• fix_complexity: low / medium / high
• fix_dependencies: finding IDs that must be fixed first

Execute via ccw cli --tool gemini --mode analysis --rule analysis-diagnose-bug-root-cause (fallback: qwen -> codex). Parse JSON array responses, merge with originals (CLI-enriched replace originals, unenriched get defaults). Write <session>/review/enriched-findings.json.

Phase 4: Report Generation

1. Combine enriched + pass_through findings 2. Cross-correlate:

• Critical files: file appears in >=2 dimensions -> list with finding_count, severities
• Root cause groups: cluster findings sharing related_findings -> identify primary
• Optimization suggestions: from root cause groups + standalone enriched findings

3. Compute metrics: by_dimension, by_severity, dimension_severity_matrix, fixable_count, auto_fixable_count 4. Write <session>/review/review-report.json: {review_id, review_date, findings[], critical_files[], optimization_suggestions[], root_cause_groups[], summary} 5. Write <session>/review/review-report.md: Executive summary, metrics matrix (dimension x severity), critical/high findings table, critical files list, optimization suggestions, recommended fix scope 6. Update <session>/.msg/meta.json with review summary 7. Contribute discoveries to <session>/wisdom/ files

Code Scanner

Toolchain + LLM semantic scan producing structured findings. Static analysis tools in parallel, then LLM for issues tools miss. Read-only -- never modifies source code. 4-dimension system: security (SEC), correctness (COR), performance (PRF), maintainability (MNT).

Phase 2: Context & Toolchain Detection

1. Extract session path, target, dimensions, quick flag from task description 2. Resolve target files (glob pattern or directory -> **/*.{ts,tsx,js,jsx,py,go,java,rs}) 3. If no source files found -> report empty, complete task cleanly 4. Detect toolchain availability:

5. Load wisdom files from <session>/wisdom/ if they exist

Phase 3: Scan Execution

Quick mode: Single CLI call with analysis mode, max 20 findings, skip toolchain.

Standard mode (sequential):

3A: Toolchain Scan

Run detected tools in parallel via Bash backgrounding. Each tool writes to <session>/scan/tmp/<tool>.{json|txt}. After wait, parse each output into normalized findings:

• tsc: file(line,col): error TSxxxx: msg -> dimension=correctness, source=tool:tsc
• eslint: JSON array -> severity 2=correctness/high, else=maintainability/medium
• semgrep: {results[]} -> dimension=security, severity from extra.severity
• ruff: [{code,message,filename}] -> S=security, F/B*=correctness, else=maintainability
• mypy: file:line: error: msg [code] -> dimension=correctness
• npm audit: {vulnerabilities:{}} -> dimension=security, category=dependency

Write <session>/scan/toolchain-findings.json.

3B: Semantic Scan (LLM via CLI)

Build prompt with target file patterns, toolchain dedup summary, and per-dimension focus areas:

• SEC: Business logic vulnerabilities, privilege escalation, sensitive data flow, auth bypass
• COR: Logic errors, unhandled exception paths, state management bugs, race conditions
• PRF: Algorithm complexity, N+1 queries, unnecessary sync, memory leaks, missing caching
• MNT: Architectural coupling, abstraction leaks, convention violations, dead code

Execute via ccw cli --tool gemini --mode analysis --rule analysis-review-code-quality (fallback: qwen -> codex). Parse JSON array response, validate required fields (dimension, title, location.file), enforce per-dimension limit (max 5 each), filter minimum severity (medium+). Write <session>/scan/semantic-findings.json.

Tech Profile Scan

After scanning, note any codebase characteristics relevant to review focus:

1. Check scan findings → signals (injection_risk, eval_usage, sql_detected, auth_detected) 2. Check code quality patterns → signals (legacy_patterns, test_gap, perf_sensitive) 3. Include tech_profile in Phase 5 state_update data:

   "tech_profile": { "signals": ["<detected>"], "evidence": { "<signal>": ["<files>"] } }

Phase 4: Aggregate & Output

1. Merge toolchain + semantic findings, deduplicate (same file + line + dimension = duplicate) 2. Assign dimension-prefixed IDs: SEC-001, COR-001, PRF-001, MNT-001 3. Write <session>/scan/scan-results.json with schema: {scan_date, target, dimensions, quick_mode, total_findings, by_severity, by_dimension, findings[]} 4. Each finding: {id, dimension, category, severity, title, description, location:{file,line}, source, suggested_fix, effort, confidence} 5. Update <session>/.msg/meta.json with scan summary (findings_count, by_severity, by_dimension) 6. Contribute discoveries to <session>/wisdom/ files

Review Dimensions (4-Dimension System)

Security (SEC)

Vulnerabilities, attack surfaces, and data protection issues.

Categories: injection, authentication, authorization, data-exposure, encryption, input-validation, access-control

Tool Support: Semgrep (--config auto), npm audit, tsc strict mode LLM Focus: Business logic vulnerabilities, privilege escalation paths, sensitive data flows

Severity Mapping:

• Critical: RCE, SQL injection, auth bypass, data breach
• High: XSS, CSRF, insecure deserialization, weak crypto
• Medium: Missing input validation, overly permissive CORS
• Low: Informational headers, minor config issues

---

Correctness (COR)

Bugs, logic errors, and type safety issues.

Categories: bug, error-handling, edge-case, type-safety, race-condition, null-reference

Tool Support: tsc --noEmit, ESLint error-level rules LLM Focus: Logic errors, unhandled exception paths, state management bugs, race conditions

Severity Mapping:

• Critical: Data corruption, crash in production path
• High: Incorrect business logic, unhandled error in common path
• Medium: Edge case not handled, missing null check
• Low: Minor type inconsistency, unused variable

---

Performance (PRF)

Inefficiencies, resource waste, and scalability issues.

Categories: n-plus-one, memory-leak, blocking-operation, complexity, resource-usage, caching

Tool Support: None (LLM-only dimension) LLM Focus: Algorithm complexity, N+1 queries, unnecessary sync operations, memory leaks, missing caching

Severity Mapping:

• Critical: Memory leak in long-running process, O(n³) on user data
• High: N+1 query in hot path, blocking I/O in async context
• Medium: Suboptimal algorithm, missing obvious cache
• Low: Minor inefficiency, premature optimization opportunity

---

Maintainability (MNT)

Code quality, readability, and structural health.

Categories: code-smell, naming, complexity, duplication, dead-code, pattern-violation, coupling

Tool Support: ESLint warning-level rules, complexity metrics LLM Focus: Architectural coupling, abstraction leaks, project convention violations

Severity Mapping:

• High: God class, circular dependency, copy-paste across modules
• Medium: Long method, magic numbers, unclear naming
• Low: Minor style inconsistency, commented-out code
• Info: Pattern observation, refactoring suggestion

---

Why 4 Dimensions (Not 7)

The original review-cycle used 7 dimensions with significant overlap:

4 dimensions = clear ownership, no overlap, each maps to distinct tooling.

Review Pipelines

Pipeline definitions and task registry for team-review.

Pipeline Modes

Pipeline Definitions

default Mode (2 tasks, linear)

SCAN-001 -> REV-001

full Mode (3 tasks, linear with user checkpoint)

SCAN-001 -> REV-001 -> [user confirm] -> FIX-001

fix-only Mode (1 task)

FIX-001

quick Mode (1 task)

SCAN-001 (quick=true)

Review Dimensions (4-Dimension System)

Fix Scope Options

Session Directory

.workflow/.team/RV-<slug>-<YYYY-MM-DD>/
├── .msg/messages.jsonl          # Message bus log
├── .msg/meta.json               # Session state + cross-role state
├── wisdom/                     # Cross-task knowledge
│   ├── learnings.md
│   ├── decisions.md
│   ├── conventions.md
│   └── issues.md
├── scan/                       # Scanner output
│   ├── toolchain-findings.json
│   ├── semantic-findings.json
│   └── scan-results.json
├── review/                     # Reviewer output
│   ├── enriched-findings.json
│   ├── review-report.json
│   └── review-report.md
└── fix/                        # Fixer output
    ├── fix-manifest.json
    ├── fix-plan.json
    ├── execution-results.json
    ├── verify-results.json
    ├── fix-summary.json
    └── fix-summary.md