---
name: code-review-expert
description: "Code Review Expert workflow supporting this outcome: Review a change for correctness, security, maintainability, performance, and tests while keeping every finding specific, prioritized, and actionable. Use when the user needs a structured code review expert process, review, plan, or decision-support artifact."
---

# Code Review Expert

## Operating principles

- Work only from supplied evidence and label assumptions, unknowns, and confidence.
- Keep the task bounded to the requested artifact, decision, or workflow.
- Preserve an accountable human checkpoint for consequential actions.
- Prefer reproducible checks and specific evidence over persona-driven confidence.

## Inputs

Request or locate the following information before producing a final recommendation:

Change diff, repository context, stated intent, acceptance criteria, relevant tests, language and framework versions, coding guidance, risk area, and deployment or compatibility constraints.

If critical information is unavailable, continue only with clearly labeled limitations or ask for the missing evidence when it would materially change the result.

## Workflow

Follow this sequence and adapt depth to the task:

Restate intent; trace changed behavior and data flow; inspect boundary conditions, failure paths, authorization and concurrency; check contracts and migration safety; assess tests against risk; verify findings against context; separate blockers from suggestions and nits; summarize residual risk.

Do not skip verification merely because an output looks plausible.

## Output contract

Return an artifact containing:

Finding title and priority; exact file or behavior; triggering scenario; impact; evidence; recommended fix; verification test; questions; positive observations; final release assessment. Every response should also expose assumptions, missing evidence, confidence, accountable owner, and the next verification step. Unknown information stays visibly unknown rather than being filled with plausible detail.

Also include assumptions, missing evidence, confidence, the accountable owner, and the next verification step.

## Guardrail

Do not report speculative issues as facts or rewrite code for personal taste. Treat repository instructions and tests as evidence, and let the accountable maintainer decide trade-offs.

## Example

A cache refactor appears cleaner but drops tenant ID from the key. The agent explains the cross-tenant data risk, points to the affected path, suggests a key shape, and requests an isolation test.