# Stage 6: Review

## Purpose

Specialist review of code quality, security, and spec compliance.

## Input

- PR diff from Coding stage
- **Full module context** for changed files (not just the diff — reviewers need surrounding code to understand invariants, callers, and integration points)
- Implementation spec from Planning 2
- Acceptance criteria from Planning 3
- Context packet from Planning 3 (includes relevant files/symbols beyond the diff)

## Composition — DYNAMIC

| Role                | Model  | Always/Conditional                               |
| ------------------- | ------ | ------------------------------------------------ |
| Code Reviewer       | Sonnet | Always                                           |
| Security Auditor    | Opus   | Always (every PR gets security review)           |
| Language Specialist | Sonnet | The relevant language specialist from Planning 2 |

## Process

1. Code Reviewer: evidence-driven review
   - Correctness risks and behavior regressions
   - Contract changes that may break callers
   - Missing or weak tests
   - Severity-ranked findings (CRITICAL / HIGH / MEDIUM / LOW)
2. Security Auditor: focused security review
   - Auth/authz boundaries and privilege escalation
   - Input validation and injection resistance
   - Secrets handling across code, config, runtime, logs
   - Supply-chain dependencies
3. Language Specialist: domain-specific review
   - Language idioms and best practices
   - Known project-specific gotchas (from specialist memory)
   - Framework-specific issues (e.g., NestJS import rules)

## Output

- Review report per reviewer:
  - Findings with severity, evidence, file/line references
  - Recommended fix per finding
  - Residual risk assessment
- Combined verdict: PASS / FAIL (with specific findings to address)

## Gate: review-pass

### Mechanical

- [ ] All three reviews completed
- [ ] No CRITICAL findings unaddressed
- [ ] No HIGH findings unaddressed (unless explicitly accepted with rationale)

### Gate Reviewer

- "Are the fixes real, or did the worker just suppress warnings? Any residual risk?"

## On FAIL

→ Proceeds to Stage 7: Remediate, then loops back to Review
