Claude-Code-Workflow/.claude/skills/workflow-execute/phases/06-review.md

Phase 6: Post-Implementation Review

Optional specialized review for completed implementations. In the standard workflow, passing tests = approved code. This phase executes only when user selects "Enter Review" in Phase 5 completion.

Objective

• Perform specialized review (security/architecture/quality/action-items) on completed implementation
• Generate structured review report with severity levels and action items
• Provide CLI-assisted analysis using Gemini/Qwen for deep review

Philosophy: "Tests Are the Review"

• Default: All tests pass → Code approved
• Optional: This phase for specialized reviews:
  • Security audits (vulnerabilities, auth/authz)
  • Architecture compliance (patterns, technical debt)
  • Action items verification (requirements met, acceptance criteria)
  • Code quality assessment (best practices, maintainability)

Review Types

Type	Focus	Use Case
quality	Code quality, best practices, maintainability	Default general review
security	Security vulnerabilities, data handling, access control	Security audits
architecture	Architectural patterns, technical debt, design decisions	Architecture compliance
action-items	Requirements met, acceptance criteria verified	Pre-deployment verification

Notes:

• For documentation generation, use /workflow:tools:docs
• For CLAUDE.md updates, use /update-memory-related

Execution

Step 6.1: Review Type Selection

Prompt user to select review type:

AskUserQuestion({
  questions: [{
    question: "Select review type:",
    header: "Review Type",
    multiSelect: false,
    options: [
      { label: "Quality (Recommended)", description: "Code quality, best practices, maintainability" },
      { label: "Security", description: "Security vulnerabilities, data handling, access control" },
      { label: "Architecture", description: "Architectural patterns, technical debt, design decisions" },
      { label: "Action Items", description: "Requirements met, acceptance criteria verified" }
    ]
  }]
})

Auto Mode (--yes): Skip selection, default to quality.

Step 6.2: Validation

# Verify completed implementation exists
sessionPath=".workflow/active/${sessionId}"

if [ ! -d "${sessionPath}/.summaries" ] || [ -z "$(find ${sessionPath}/.summaries/ -name "IMPL-*.md" -type f 2>/dev/null)" ]; then
    echo "No completed implementation found. Complete implementation first."
    exit 1
fi

Step 6.3: Context Loading

# Load implementation summaries
for summary in ${sessionPath}/.summaries/*.md; do
  cat "$summary"
done

# Load test results (if available)
for test_summary in ${sessionPath}/.summaries/TEST-FIX-*.md 2>/dev/null; do
  cat "$test_summary"
done

# Get changed files
git log --since="$(cat ${sessionPath}/workflow-session.json | jq -r .created_at)" --name-only --pretty=format: | sort -u

Step 6.4: Specialized Review Analysis

Based on review_type, execute the corresponding analysis:

Security Review (security):

# Pattern scan
rg "password|token|secret|auth" -g "*.{ts,js,py}"
rg "eval|exec|innerHTML|dangerouslySetInnerHTML" -g "*.{ts,js,tsx}"

# Gemini security analysis
ccw cli -p "
PURPOSE: Security audit of completed implementation
TASK: Review code for security vulnerabilities, insecure patterns, auth/authz issues
CONTEXT: @.summaries/IMPL-*.md,../.. @../../project-tech.json @../../project-guidelines.json
EXPECTED: Security findings report with severity levels
RULES: Focus on OWASP Top 10, authentication, authorization, data validation, injection risks
" --tool gemini --mode write --cd ${sessionPath}

Architecture Review (architecture):

ccw cli -p "
PURPOSE: Architecture compliance review
TASK: Evaluate adherence to architectural patterns, identify technical debt, review design decisions
CONTEXT: @.summaries/IMPL-*.md,../.. @../../project-tech.json @../../project-guidelines.json
EXPECTED: Architecture assessment with recommendations
RULES: Check for patterns, separation of concerns, modularity, scalability
" --tool qwen --mode write --cd ${sessionPath}

Quality Review (quality):

ccw cli -p "
PURPOSE: Code quality and best practices review
TASK: Assess code readability, maintainability, adherence to best practices
CONTEXT: @.summaries/IMPL-*.md,../.. @../../project-tech.json @../../project-guidelines.json
EXPECTED: Quality assessment with improvement suggestions
RULES: Check for code smells, duplication, complexity, naming conventions
" --tool gemini --mode write --cd ${sessionPath}

Action Items Review (action-items):

# Load task requirements and acceptance criteria
for task_file in ${sessionPath}/.task/*.json; do
  cat "$task_file" | jq -r '
    "Task: " + .id + "\n" +
    "Requirements: " + .description + "\n" +
    "Acceptance: " + (.convergence.criteria | join(", "))
  '
done

# Cross-check implementation against requirements
ccw cli -p "
PURPOSE: Verify all requirements and acceptance criteria are met
TASK: Cross-check implementation summaries against original requirements
CONTEXT: @.task/IMPL-*.json,.summaries/IMPL-*.md,../.. @../../project-tech.json @../../project-guidelines.json
EXPECTED:
- Requirements coverage matrix
- Acceptance criteria verification
- Missing/incomplete action items
- Pre-deployment readiness assessment
RULES:
- Check each requirement has corresponding implementation
- Verify all acceptance criteria are met
- Flag any incomplete or missing action items
- Assess deployment readiness
" --tool gemini --mode write --cd ${sessionPath}

Step 6.5: Generate Review Report

Write structured report to session directory:

# Review Report: ${review_type}

**Session**: ${sessionId}
**Date**: $(date)
**Type**: ${review_type}

## Summary
- Tasks Reviewed: [count IMPL tasks]
- Files Changed: [count files]
- Severity: [High/Medium/Low]

## Findings

### Critical Issues
- [Issue 1 with file:line reference]

### Recommendations
- [Recommendation 1]

### Positive Observations
- [Good pattern observed]

## Action Items
- [ ] [Action 1]
- [ ] [Action 2]

Output: ${sessionPath}/REVIEW-${review_type}.md

Step 6.6: Post-Review Prompt

Review complete. Would you like to:
→ Run another review type
→ Complete session: /workflow:session:complete

If architecture or quality issues found, suggest:

Consider updating project documentation:
→ /update-memory-related

Output

• File: ${sessionPath}/REVIEW-${review_type}.md
• TodoWrite: Mark Phase 6 completed

Next Phase

Return to orchestrator for session completion or additional review cycles.