review

Review the current diff with the reviewer fleet, funneled to one triaged verdict.

What it does

A read-only review of the current change, dispatched by path against a reviewer-to-path matrix: security-reviewer for auth/middleware/secrets/deploy paths, auth-crypto-reviewer for authn/crypto/key handling, dependency-reviewer for manifest/lockfile changes, migration-reviewer for DB migrations, coverage-auditor for any source change, and architecture-drift-reviewer for code that may diverge from an accepted ADR. Each matched reviewer runs as one read-only unit through dispatching-parallel-agents; the results are deduped, then funneled through finding-triage (severity plus an inline [NEEDS-TRIAGE] marker on anything out of scope) and checkpoint-aggregator down to a single verdict. No file is modified by a run. A finding that turns on a genuinely-unresolved unknown surfaces as a numbered CONFIRM-NN rather than being resolved by guessing.

Findings are surfaced by severity (CRITICAL/HIGH/MEDIUM/LOW), file:line, remediation, and — for security findings — the specific control in .codearbiter/security-controls.md they map to. Raw per-reviewer output is never consumed directly; only the triaged, aggregated verdict is.

On Codex, these reviewer roles execute inline in the current thread rather than through isolated Task-tool dispatch — see Claude Code + Codex → Intentional host differences.

Usage

/ca:review [path]

Defaults to the current uncommitted diff when no path is given.

Example

> /ca:review

Dispatched: security-reviewer, auth-crypto-reviewer (src/auth/session.ts)
            coverage-auditor (src/auth/session.ts, src/auth/login.test.ts)

HIGH   src/auth/session.ts:41  Session token generated with Math.random(),
       not a CSPRNG. Control: security-controls.md §Randomness.
LOW    src/auth/login.test.ts  No test for expired-token rejection path.

Verdict: 1 HIGH, 1 LOW — HIGH must be resolved before /ca:pr.

When to reach for it

/ca:pr already dispatches this automatically when opening a PR, so a manual run is for checking before that point; a periodic full-codebase sweep is /ca:checkpoint’s job, and a pre-implementation threat model is /ca:threat-model’s. A read-only look before onboarding at all is /ca:preview.

Gates

Gate	When	Effect
severity block	any CRITICAL or HIGH finding surfaces	must be resolved before /ca:pr — the aggregated verdict is not advisory at that severity

Source

Source — plugins/ca/commands/review.md (v2.9.1)

---
description: Review the current diff with the reviewer fleet, funneled to one triaged verdict.
argument-hint: "[path]" (defaults to the current diff)
---

# /ca:review — diff review

Read-only review of the current change. Routes to `dispatching-parallel-agents`: dispatches the reviewer fleet by path matrix, dedupes, then funnels through `finding-triage` → `checkpoint-aggregator` to a single verdict. No code is modified.

## Flow

1. Resolve scope — `$ARGUMENTS` if a path is given, else the current diff.
2. Build the unit list by path matrix; each matched reviewer is one read-only unit:

   | Reviewer | Dispatched when scope touches |
   |---|---|
   | `security-reviewer` | auth, middleware, secrets, deploy/CI, any security-sensitive path |
   | `auth-crypto-reviewer` | authn, crypto, key handling, secrets |
   | `dependency-reviewer` | `package.json`, lockfiles, base images, dependency manifests |
   | `migration-reviewer` | DB migration file add/modify |
   | `coverage-auditor` | any source change (test coverage vs. obligations) |
   | `architecture-drift-reviewer` | code that may diverge from accepted ADRs in `.codearbiter/decisions/` |

3. Route to `dispatching-parallel-agents` with that unit list (read-only batch — no collision check).
   It dedupes overlapping findings, then funnels through `finding-triage` (severity + inline
   `[NEEDS-TRIAGE]` on out-of-scope items) → `checkpoint-aggregator` (single verdict).
4. Surface the aggregated verdict: findings by severity, file:line, remediation, and the applicable
   control from `${CLAUDE_PROJECT_DIR}/.codearbiter/security-controls.md` for security findings.

## Severity

- **CRITICAL** — exploitable vuln, secret exposure, banned primitive, data-integrity breach.
- **HIGH** — significant compliance gap or unsafe pattern.
- **MEDIUM** — standards deviation or coverage gap.
- **LOW** — informational or style.

## Hard gate

Read-only — MUST NOT modify a file. BLOCK on any CRITICAL or HIGH finding: it must be resolved before
`/ca:pr`. MUST NOT consume raw reviewer output — only the `finding-triage` → `checkpoint-aggregator`
verdict. MUST NOT resolve a `[CONFIRM-NN]` surfaced during review by guessing.

## When NOT to use

- Opening a PR (reviews dispatch automatically) → `/ca:pr`.
- A periodic full-codebase sweep → `/ca:checkpoint`.
- A pre-implementation threat model → `/ca:threat-model`.
- A question about the code → `/ca:btw`.

View in repo