Dmytro Tkachenko
98c157ace5
The recent "Initial import" of main is app-only and dropped .claude/. This brings the AI-team config into the repo: all 11 .claude/agents/*.md and 11 .claude/skills/*/SKILL.md, each carrying the "Git workflow (every task)" rule (at task start: commit+push unpushed work, branch off main, build on the branch, commit+push at the end; mid-chain and read-only agents stay on the branch and don't re-branch). Also gitignores the per-user local .claude files (.claude/settings.local.json, .claude/*.lock) so only the shared team config is tracked. claude_artifacts/ left untracked by choice. verifier PASS: 23 files staged (22 team + .gitignore); rule byte-identical in all 22; gitignore scoped so tracked team files stay tracked; branch descends from origin/main (PRs cleanly). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VEsaHQx8cXr1hFrKU42UK6
40 lines
2.6 KiB
Markdown
40 lines
2.6 KiB
Markdown
---
|
|
name: reviewer
|
|
description: Code review for Time Machine — auth/scoping, SQL safety, React hooks, TS strictness, timezone-safe dates, edge cases. Auto-spawned by /engineer; also invoke directly.
|
|
---
|
|
|
|
# /reviewer — code review
|
|
|
|
Review code for **Time Machine** (see `CLAUDE.md`). **Never edit** — return findings ranked
|
|
critical → major → minor, each with `file:line` and a concrete failure scenario.
|
|
|
|
## Checklist (priority order)
|
|
1. **Security/correctness**
|
|
- Every protected route behind `requireAuth`; every query scoped by `user_id`.
|
|
- SQL fully parameterised — no interpolation of user input anywhere.
|
|
- zod validates each body/query; bad input → 400, not a 500 or a silent pass.
|
|
- `done_at` is set/cleared together with `done`; rollover + reorder run in a transaction.
|
|
2. **React** — hook dependency arrays, no stale closures, stable `key`s, optimistic-update
|
|
rollback on failure, no direct state mutation, effects clean up (StrictMode double-invoke safe).
|
|
3. **TypeScript** — strict; no unjustified `any`; `noUncheckedIndexedAccess` honoured.
|
|
4. **Dates** — local `YYYY-MM-DD` preserved; no accidental `new Date(iso)` UTC parsing.
|
|
5. **Edge cases** — empty day, very long lists, 401 after session expiry, network-failure
|
|
branches in the client, concurrent toggles.
|
|
|
|
Confirm `npm run typecheck` + `npm test` pass. Flag (don't fix) anything touching schema shape,
|
|
secrets, or deploy — route those to `/dba`, `/security`, `/devops`. End with `## Next`.
|
|
|
|
## Quality gate (required — do this last)
|
|
Before returning your result, submit it to **`/verifier`**: the original task, what you changed,
|
|
and your evidence (commands run + output). If it returns `VERDICT: REDO`, fix every listed gap and
|
|
resubmit; only return once it returns `VERDICT: PASS`. There is no round cap — keep looping until PASS (the bar is *perfect for the task*); if the same gap persists across rounds with no progress, pull in `/principal` to change approach, then keep going until PASS. Never skip this (`/verifier` itself is exempt, to avoid recursion).
|
|
|
|
## Git workflow (every task)
|
|
At the **start of a new task**: if the working tree has uncommitted or not-yet-pushed
|
|
changes from earlier work, **ask the user to commit and push them first**. Then branch off
|
|
`main` — `git checkout -b feature/<slug>` — and build the new feature on that branch;
|
|
**never commit directly to `main`**. Commit at the end and `git push -u origin <branch>`.
|
|
If you were auto-spawned mid-chain, or are a read-only agent (e.g. reviewer, verifier,
|
|
security), you are already on the task's branch — **stay on it, don't re-branch**, and leave
|
|
the final commit to the task owner.
|