Code Review & Quality for Claude Code

Retroactive 6-pillar visual audit of implemented frontend code. Produces scored UI-REVIEW.md. Spawned by /gsd:ui-review orchestrator.

Validates UI-SPEC.md design contracts against 6 quality dimensions. Produces BLOCK/FLAG/PASS verdicts. Spawned by /gsd:ui-phase orchestrator.

Verifies phase goal achievement through goal-backward analysis. Checks codebase delivers what phase promised, not just that tasks completed. Creates VERIFICATION.md report.

Tier 1 (surface) Ralph Review. Dispatched by the /ralph-review command. Runs fast, cheap surface validation against a finished implementation diff. Never writes code.

Delegates autonomous implementation work to a Codex agent running in an isolated git worktree. Use when the task is a self-contained code change (bug fix, feature addition, refactor) that can finish without interactive clarification. The Codex agent will create a branch, commit its work, and return a summary — Claude reviews the diff before merging. Do NOT use for exploratory work, research, or anything requiring cross-cutting synthesis across the codebase.

Writer and builder specialist for schema migrations, adapter ports, dashboard patches, vault note synthesis, and any code edit with bounded scope. Receives a complete spec and returns a diff or built artifact. Part of the operator-kit five-agent starter kit.

Tier 3 (deep) Ralph Review. Dispatched by the /ralph-review command after Tier 2 passes. Runs thorough architectural review — fit, standards, governance drift, null propagation, config wiring, factual-claims audit. Never writes code.

Runs a Codex-powered read-only code review using a SOTA GPT model. Use as a second-opinion reviewer alongside Claude's own review for PRs, contentious diffs, or security-sensitive changes. Useful precisely because it's a different model family — it catches different classes of issues than Claude does.

Tier 2 (logic) Ralph Review. Dispatched by the /ralph-review command after Tier 1 passes. Runs medium-depth logic validation — evidence quality, scope alignment, fail-fast, observability, cross-boundary contracts. Never writes code.

Investigates a specific issue from Sentry, Linear, or GitHub. Finds the root cause in code, checks if it's already fixed, and either confirms resolution or creates a fix branch with a PR.

Agent that verifies build, lint, test, and checklist after TASK completion within a WORK. Automatically invoked by the scheduler. Verifies in read-only mode without modifying code.

Technical health agent. Analyzes architecture, tech debt, production risks, scalability limits, and cut corners. Brutally honest about what will break.

Use when reviewing user-facing UI for WCAG conformance, keyboard navigation, screen-reader semantics, or reduced-motion support — verifies accessibility against the ui and frontend persona standards.

Use when code contains non-trivial algorithms, loops, recursion, or data-structure choices — the specialist that analyzes the time/space complexity (Big-O) of every routine and proposes a lower-complexity algorithm or data structure where one exists. Verifies against the performance and scientific persona standards.

Implements code for any technology stack strictly from sprint spec files, then returns a structured IMPLEMENTATION REPORT with conformity status and deviations. Use when no specialized agent covers the required tech, or for cross-stack implementation tasks. Trigger with "implement sprint task", "build from specs".

Use when reviewing HTTP/RPC/GraphQL endpoints, request/response contracts, input validation, or error semantics — verifies the API surface against the api persona standards.

Scans a codebase for dangerous async patterns — floating promises, async forEach, missing await, unhandled rejections, and mixed styles — with confidence scoring and remediation guidance. Never auto-applies fixes. Use when auditing Node.js or TypeScript code for async safety issues. Trigger with "find async issues", "scan for floating promises".

Use when reviewing service-layer logic, module boundaries, business rules, or cross-service contracts — verifies architecture integrity and service correctness against the api and architect persona standards.

Use this agent when auditing bead epics for closure drift — finding open epics whose entire child set is already closed (so their GitHub/Plane cluster issue never got the close fan-out), or otherwise reasoning about epic/subtree completion across a bd Dolt database.

Writes developer-facing changelogs, deprecation notices, and migration guides so breaking changes are never a surprise. Use when you need release notes, a sunset timeline, or a step-by-step migration path. Trigger with \"write the changelog\", \"document this breaking change\".

Detects circular module dependencies using madge/dependency-cruiser, classifies each cycle as runtime-critical or type-only, and proposes minimal-blast-radius resolution strategies. Never auto-applies fixes. Use when debugging mysterious initialization failures or reducing bundle size. Trigger with "find circular dependencies", "untangle module cycles".

Use this agent when the user requests coding assistance with a declared assistance level (1-4) or mentions graduated assistance, pair programming, or preventing skill atrophy.

Detects breaking API changes before they ship and designs deprecation lifecycles that give developers time to migrate. Use when you need a semver audit, a compatibility policy, or a CI gate for API drift. Trigger with \"audit this API for breaking changes\", \"design a deprecation policy\".

Run enterprise-tier skill compliance validation, populate the freshie SQLite database, and report grade distribution, average score, worst offenders, and B-grade upgrade candidates. Use when measuring overall marketplace quality or identifying skills that need remediation. Trigger with \"run compliance validation\", \"grade the inventory\".

Cryptography implementation specialist that reviews cipher selection, key management, hashing algorithms, and TLS config — catches ECB mode, IV reuse, weak keys, and missing AEAD with secure code examples. Use when you need crypto guidance or a cryptographic code review. Trigger with \"review my crypto\", \"how should I encrypt this\".

Use when reviewing data pipelines, numerical/ML code, model training/inference, or analytics correctness — verifies reproducibility and numerical correctness against the scientific and db persona standards.

Use when database performance is in question — query optimization, indexing strategy, query plans, schema/access-pattern tradeoffs, or "is this the fastest way to read/write this data". The DB performance specialist (distinct from database-reviewer, which owns migration correctness/reversibility). Verifies against the db and performance persona standards.

Use when reviewing schema changes, migrations, indexes, or query patterns — verifies reversibility, index strategy, and query-plan correctness against the db persona standards.

Scans for unused exports, dead imports, unreachable code, and stale feature flags using knip/vulture/deadcode, auto-removes high-confidence findings after build verification, and flags the rest for manual review. Use when cleaning up a codebase before a refactor or release. Trigger with "find dead code", "remove unused exports".

Use when finding the root cause of a bug, failing test, or regression — runs systematic 5-Whys and parallel hypothesis testing before any patch. The root-cause investigator behind /hyperflow:trace.

Scans TypeScript/JavaScript for unnecessary null checks, impossible try/catch blocks, redundant validation, and dead catch blocks — tracing data flow to prove each defense is unneeded before flagging. Use when you want to clean up defensive-programming noise after strictNullChecks is on. Trigger with \"find unnecessary null checks\", \"audit defensive code\".

Detects copy-pasted code blocks (10+ lines), near-clones, and repeated patterns that warrant abstraction — using jscpd and grep-based analysis, with a hard bias against premature extraction. Use when you suspect significant code duplication is inflating maintenance burden. Trigger with \"find duplicate code\", \"DRY audit\".

Use when reviewing changes to UI components, hooks, client state, or rendering logic (React/Vue/Svelte) — verifies component correctness, state topology, and render purity against the frontend and ui persona standards.

Builds CI gates that enforce API quality before changes merge — Spectral lint rules, breaking change detection, and governance tooling for OpenAPI/GraphQL/protobuf. Use when designing API lint rulesets, integrating quality gates into CI, or auditing API governance gaps. Trigger with \"design API lint rules\", \"add API quality gate to CI\".

Audits UI code for WCAG 2.1 compliance using automated tools (Lighthouse, axe-core, pa11y) and manual checklists covering contrast, keyboard navigation, ARIA, and screen reader compatibility, then writes dated reports. Use when reviewing a new UI component or checking accessibility before release. Trigger with "check accessibility", "a11y audit for X".

Reviews APIs for REST compliance, naming consistency, OpenAPI coverage, and security posture. Use when adding endpoints, auditing an existing API, or standardizing a messy surface. Trigger with \"audit the API\", \"review endpoint design\".

Validates code across syntax, logic, security, performance, and accessibility dimensions using multi-model synthesis, then produces a prioritized report with corrected snippets. Use after code generation or before production hand-off. Trigger with "check this code for errors", "validate the generated code".