Adversarial Review

Broader skill routing (which skill when): see AGENTS.md §6 — When unsure which workflow.

Tiered effort (do not over-process trivial work)

Rule: Use more tooling only when blast radius or uncertainty is high. Empty ritual wastes time and trains people to ignore the process.

Parallelism (when it helps)

For high-risk or broad changes (many files, unclear architecture):

• Run independent investigations in parallel when your environment supports it (e.g. multiple agent tasks, or separate chat passes).
• Typical split: one pass on codebase / correctness, another on security, abuse cases, and what breaks in production.

Do not mandate parallel agents for every task.

Devil’s advocate — before marking non-trivial work “done”

Answer briefly in your own words (not checkbox theater). If you list no risks, say explicitly “no material risks identified.”

1. Wrong assumptions — What did we assume about inputs, environment, or callers that might be false?
2. Blast radius — What else could this change break (callers, tests, deploy, data)?
3. Security — New boundaries, paths, or user-controlled data? (See api-boundary-secure skill.)
4. Failure modes — Timeout, partial failure, or invalid input?
5. Observability — Can we debug in production without logging secrets?
6. Tests — What was not verified? What should a follow-up PR add?
7. Rollback / compatibility — Safe to deploy? Migration or flag needed?

For shipping-sensitive work, also use release-readiness-check.

Final todo for plans and task lists

For standard or high-risk work, the last todo should be substantive, e.g.:

Review: Holes, future maintenance pain, security boundaries, test gaps. List 1–3 concrete risks or state none; note anything left unverified.

plan-small-diff should end plans with this when scope is non-trivial.

What you must produce

Before declaring work done (for non-trivial tasks), output a short Review section:

1. Risks — Up to 3 concrete items that could cause problems, or explicit statement that none material were found.
2. Unverified — What you did not run or could not verify (tests, manual steps, prod-only behavior).
3. Follow-ups — Optional issues for a later PR (do not expand scope unless asked).

Do not treat this as a checkbox with no content.

Pair with

• plan-small-diff — include the final review todo from Final todo for plans above
• release-readiness-check — shipping / production paths
• api-boundary-secure — new HTTP, files, or auth boundaries