80/20 Review

Core Principles

1. Review at checkpoints, not continuously — Constant review interrupts flow. Schedule reviews at natural breakpoints: post-implementation, pre-PR, post-integration, and post-deploy. Each checkpoint has a different focus.

2. Focus on data access, security, concurrency, integration — These are the 20% of code areas that cause 80% of production incidents. A missing CancellationToken is more dangerous than a misnamed variable. Review depth should match risk.

3. Blast radius determines depth — A utility function used in one place gets a glance. A middleware change that affects every request gets a thorough review. Score changes by blast radius and invest review time proportionally.

4. Automate the trivial — Formatting, import ordering, naming conventions, and basic anti-patterns should be caught by tools (formatters, analyzers, hooks), not humans. Save human attention for things tools can't catch: logic errors, design flaws, and missing edge cases.

Patterns

Checkpoint Schedule

Review at these natural breakpoints, each with a specific focus: