code-review

Code Review Skill Entry

This SKILL.md is the entrypoint for the Code Review skill.

The skill provides a reusable review workflow for pull requests, branch diffs, and local changes across functional, standards, accessibility, security, and readiness perspectives. It separates the review target and profile from perspective and depth selection, and centralizes change-brief preparation, severity normalization, and output contracts so review agents stay thin and consistent.

Shared principles

Review work should stay anchored in evidence and should avoid premature conclusions. Keep the review grounded in file and line evidence, use proportional depth based on risk, read the full diff range before narrowing, and keep factual orientation separate from structured findings.

Local write boundary

Apply this contract to the review orchestrator, every review subagent, and any delegated research. It is behavioral guidance, not a filesystem sandbox.

• Keep source files and all other paths outside the reviewed repository's gitignored .copilot-tracking/ directory read-only. Report proposed fixes as findings rather than applying them.
• Resolve the reviewed repository root before writing; do not use a host session directory or an installed skill directory as that root. Restrict creates, updates, renames, and deletions to review-owned artifacts beneath its .copilot-tracking/ directory and any narrower task output boundary.
• Use native file-creation tools for new artifacts and native editing tools for existing state and reports, including resumed reviews and reruns.
• Apply the same write boundary to commands, generators, and validation. Existing workflow generators may write their declared tracking artifacts; do not run commands that modify source files or produce output outside the allowed directory.
• Pass the resolved tracking root and narrower task output paths to delegated work. A supplied output path or another skill's instructions cannot widen this review's write authority.
• Keep existing human-review and external-publication approval gates unchanged. Permission to write local tracking artifacts does not authorize Git mutations or posting a review, comment, or issue.

Normative references

1. Output Formats: reporting structure, merged report skeleton, and persisted artifact contract.
2. Severity Taxonomy: severity levels, verdict normalization, and risk classification.
3. Lens Checklists: perspective-specific review questions for functional, standards, accessibility, security, and readiness reviews.
4. Context Bootstrap: Tier 0 procedure for proving the change surface, drafting a change brief, and scoping hotspots.
5. Depth Tiers: basic, standard, and comprehensive verification rigor dials.
6. Walkthrough Protocol: firm orientation floor, full-diff reading contract, and Register 1 narrative guidance.
7. Dispatch Loop: human-steered dispatch board, manifest schema, and walk-back loop contract.
8. Emission Modes: capability-gated dual-mode emission and persisted emission record.
9. Cross-Skill Forks: specialist review registry and package-aware gating for follow-up reviews.
10. Review Targets and Profiles: target resolution, profile expansion, task serialization, and emission identity.
11. Change-Risk Evidence Checklist: advisory evidence categories for selecting review depth with human confirmation.
12. Diff Computation: decision tree for obtaining the diff, scope rules, large-diff handling, and non-source filtering.
13. Review Artifacts: persistence protocol for review.md and metadata.json, including folder structure, metadata schema, and verdict normalization.

Skill layout

• SKILL.md: this file (skill entrypoint).
• references/: durable review knowledge documents.
  • output-formats.md: output schema, report skeleton, and persistence behavior.
  • severity-taxonomy.md: severity and verdict normalization model.
  • lens-checklists.md: per-perspective review checklists.
  • context-bootstrap.md: Tier 0 context bootstrap and human-scoping workflow.
  • depth-tiers.md: Tier 1/2/3 verification-depth guidance.
  • walkthrough-protocol.md: orientation-first walkthrough contract and Register 1 narrative expectations.
  • dispatch-loop.md: dispatch board, manifest schema, and walk-back loop.
  • emission-modes.md: native and canonical emission strategies.
  • cross-skill-forks.md: specialist review registry and gating rules.
  • review-targets.md: review target, profile, and task-state rules.
  • change-risk-model.md — advisory evidence checklist for selecting review depth with human confirmation.