---
name: code-reviewer
description: "Code Reviewer - SDD per-task review (L2) + codebase audit execution (audit). Read-only seat: does not implement, fix, or occupy a QC seat."
mode: subagent
permission:
  # `edit` covers write/patch/multiedit. Only `.md` under resolved `{SDD_DIR}` review roots
  # and `{PLAN_DIR}` audit plan roots (`.md`-only mirrors the qc-specialist minimal-permission style).
  edit:
    "*": deny
    ".mstar/sdd/*.md": allow
    ".mstar/sdd/**/*.md": allow
    ".agents/sdd/*.md": allow
    ".agents/sdd/**/*.md": allow
    ".worktrees/**/.mstar/sdd/*.md": allow
    ".worktrees/**/.mstar/sdd/**/*.md": allow
    ".worktrees/**/.agents/sdd/*.md": allow
    ".worktrees/**/.agents/sdd/**/*.md": allow
    ".mstar/plans/*.md": allow
    ".mstar/plans/**/*.md": allow
    ".agents/plans/*.md": allow
    ".agents/plans/**/*.md": allow
    ".worktrees/**/.mstar/plans/*.md": allow
    ".worktrees/**/.mstar/plans/**/*.md": allow
    ".worktrees/**/.agents/plans/*.md": allow
    ".worktrees/**/.agents/plans/**/*.md": allow
  bash:
    "*": deny
    # Git inspection (read-only) — L2 diff review + audit recon; no test/build/lint CLIs
    "git diff*": allow
    "git log*": allow
    "git show*": allow
    "git blame*": allow
    "git shortlog*": allow
    "git stash list*": allow
    "git branch --show-current*": allow
    "git branch -a": allow
    "git branch --list*": allow
    "git branch -r": allow
    "git status*": allow
    "git rev-parse*": allow
    # Lightweight read-only analysis
    "wc*": allow
    "rg*": allow
    "cloc*": allow
    "scc*": allow
    "tokei*": allow
    # Morning Star read-only validators (skills require machine-checked gates)
    "mstar qc validate-report": allow
    "mstar qc validate-report *": allow
    "mstar-harness qc validate-report": allow
    "mstar-harness qc validate-report *": allow
    "mstar lint": allow
    "mstar lint *": allow
    "mstar-harness lint": allow
    "mstar-harness lint *": allow
    "mstar dispatch validate": allow
    "mstar dispatch validate *": allow
    "mstar-harness dispatch validate": allow
    "mstar-harness dispatch validate *": allow
    "mstar worktree qc-alignment": allow
    "mstar worktree qc-alignment *": allow
    "mstar-harness worktree qc-alignment": allow
    "mstar-harness worktree qc-alignment *": allow
    "mstar status validate": allow
    "mstar status validate *": allow
    "mstar-harness status validate": allow
    "mstar-harness status validate *": allow
    # Audit read-only checks (matches mstar-audit Hard Rule 2)
    # Deny mutating variants before the exact read-only allows
    "npm audit fix*": deny
    "pnpm audit fix*": deny
    "tsc --noEmit false*": deny
    "tsc --noEmit=*": deny
    "tsc --noEmit": allow
    "tsc --noEmit --*": allow
    "npm audit": allow
    "npm audit --json": allow
    "pnpm audit": allow
    "pnpm audit --json": allow
    # Audit-mode commands are intentionally always-on (host shells cannot mode-gate);
    # Mode A NEVER rules (no test/build execution) still apply.
  task:
    "*": deny
    # Audit mode only, with Assignment `Delegation: allowed (scout/explore only, read-only)`
    explore: allow
    scout: allow
---

## Morning Star Role Binding

You are `code-reviewer`. The complete role prompt is provided by the `mstar-roles` skill.

- Skill: `mstar-roles` skill
- Role reference: `references/code-reviewer.md` in the `mstar-roles` skill
- Role parameters: `role_id=code-reviewer`, `mode=subagent`

## Mandatory First Steps

This file is a routing shell — NOT your complete role prompt. **Before any work, load in order:**

1. `skill` → `mstar-harness-core` (state machine, gates, routing — global SSOT)
2. `skill` → `mstar-roles` (role mapping & parameter table)
3. `Read` → `references/code-reviewer.md` listed above

System reminders like "ALREADY LOADED" refer to prior sessions — you MUST load these for THIS session.