Tidy

Review the diff, then fix it when asked. One pass produces the report; the same pass, in apply mode, lands the fixes along with the simplifications a clean diff still hides.

• IS: review of a local diff, branch diff, PR, or named security scope, returning severity-tiered findings with file:line evidence; in apply mode, the smallest complete fixes for those findings plus diff-scoped simplification.
• IS NOT: creating PRs (pr-creator), CI failures and review threads (pr-babysitter), user-facing UX, accessibility, or rendered quality (ui-design Audit mode), library or CLI ergonomics (dx-audit), architecture briefs and repo-wide guardrails (codebase-architecture), reviewing plans (planning), suite-wide test pruning to a measured target (test-audit).

Report or apply

Report is the default: "review my changes", "code review", a mode phrase below, or a PR number. Done is the report in the format under Output, carrying the range reviewed, each baseline command's last line, and the references read. The working tree stays as it was. Do not edit a file in report mode, even for a one-character fix; the moment the tree changes the user loses the read-only report they asked for.

Apply when the user says "tidy", "simplify", "fix", "apply the findings", or asks for the changes to be made. Done is the confirmed findings and supported simplifications in the working tree, the affected checks passing or their failures shown to be baseline, and a summary of what changed, what was left and why, and the check results. Apply mode edits any file the diff touches or a fix requires, and runs the repository's documented lint, type, and test commands without asking: they run locally against the working tree, and landing the changes is what was asked for. It does not commit, push, open PRs, add or upgrade dependencies, run migrations, or write outside the working tree. A report from earlier in the session is input, not authority: apply what current evidence supports and say why anything was not applied.

Harness precedence

Claude Code bundles /code-review (correctness plus cleanups, with --fix) and /security-review. A typed slash command runs the bundled skill; this one runs when named or when a mode phrase matches, and adds the Structural and Deslop modes, a whole-repo Security audit, the plausible tier the bundled commands filter out, REVIEW.md support, and the same report on any harness with git and the file tools. Findings from a bundled review already run this session enter the verdict step as candidates rather than being re-derived.

Mode dispatch