Code review checklist, security audit (OWASP Top 10), architecture compliance, refactoring patterns, code conventions. Use when: reviewing code, refactoring, auditing security, checking conventions, assessing code quality.
docs/architecture/components.md?docs/ADRs/?docs/architecture/tech-stack.md?| Level | Label | Action |
|---|---|---|
| Critical | must-fix | Blocks approval — security holes, data loss, crashes |
| Suggestion | should-fix | Important but not blocking — quality, patterns |
| Nit | optional | Style, naming, minor improvements |
When refactoring at epic boundaries, look for:
| Pattern | Signal | Action |
|---|---|---|
| Extract utility | Same logic in 2+ files | Create shared module |
| Normalize pattern | Inconsistent approach to same problem | Adopt dominant convention |
| Simplify | Cyclomatic complexity > 10 | Decompose into smaller functions |
| Remove dead code | Unreachable or unused code | Delete it |
| Extract config | Hardcoded values repeated | Move to configuration |
| Introduce type | Raw dicts/maps with known shape | Create a typed structure |
When reviewing documentation quality:
Applies only when the project includes user-facing UI components. Skip this section for backend-only, CLI-only, or infrastructure projects.
alt text (or alt="" for decorative)<label> elements