Spring code review rubric

Severity ladder

• blocker — must fix before commit. (Security hole, broken behavior, gate-bypass.)
• major — must fix before commit OR document as ADR + waiver.
• minor — should fix; leave a note if not.
• nit — taste; mention once, don't insist.

Ten sections

1. Traceability

• Every diff hunk maps to an AC-NNN and a T-NNN.
• Files-in-scope honored (no edits outside the task's declared paths).
• Any new public API has a test referencing the AC.

2. Architecture