Code Review

Hard rules

• Scope from user/task only. Unclear → ask. Don’t widen.
• Inspect thoroughly; report selectively. Candidate ≠ finding.
• “No material findings” is valid.
• No source edits unless asked. Don’t clobber owner git/worktree state.
• Main agent assigns final findings/scores/verdicts. Child handoffs = evidence.
• Delegate by default into bounded read-only lanes when safe. “Small/easy” ≠ skip.
• Leverage subagents — built-in, extensions/plugins, or skills. Follow use-subagents policy; use the host’s selected launcher (on Pi without native subagent_*, use-pi-subagents).

Admit a finding only if

• concrete failure
• realistic reachability
• practical impact
• safeguards considered
• action justified now