IRON LAW: Review read-only and report only evidence-backed findings; never fix code, commit, push, reply remotely, or trigger automation.

Code Review — Risk-Priority with Proportional Verification

Read-Only Contract

This skill owns review methods and findings only. The executing parent owns fixes and any repeat-review loop. When invoked by a subagent, remain read-only and return findings to that parent; never delegate back to the parent workflow or start a fix loop. For a direct request that includes implementation, the executing assistant must use the coding workflow for the implementation portion and pass review work here as a read-only task. This does not expand the reviewer's authority.

Inspect code, diff, context and existing evidence. Do not execute project code or tests in the reviewed checkout if they can mutate it. Use supplied verification evidence, read-only analysis, or explicitly authorized isolated checks without publication credentials; report checks that remain unverified. Review output belongs in the conversation or an explicitly requested external report artifact, not an unsolicited tracking file in the repository.

Uncertainty

Do not guess missing requirements, behavior or facts. Investigate available authoritative context first. A question that can safely wait is a pending item with its affected decision and resolution point; continue independent review. If it prevents a current correctness judgment, mark the affected scope incomplete and actively ask the user when reviewing directly, or return the concrete question to the executing parent when running as a subagent. The parent must ask the user before a dependent action when authoritative context cannot resolve it. Never convert an unanswered question or unavailable verification into a clean pass.

Workflow