---
description: "Stage-07 code review of the local diff or a PR: severity-ranked findings with file:line evidence, calibrated per OPERATING-STANDARD §7; the verdict routes through sdlc_validate/sdlc_approve — this command never writes state itself."
argument-hint: "[pr-number | --local]"
owner: RStack developed by Richardson Gunde
---

# /sdlc-review — Stage-07 Code Review

Read-only review of the current change set. Findings, never fixes.

## Scope

- `--local` (default): review `git diff main...HEAD` plus staged changes.
- `<pr-number>`: review that PR's diff via `gh pr diff`.

## Method

1. Read every changed file's diff WITH surrounding context (never the diff alone).
2. Hunt in order: correctness bugs, security issues (input handling, authz, secrets), silent failures (swallowed errors, bad fallbacks), test-coverage gaps for changed behavior, then maintainability.
3. Calibrate per the Finding Calibration rules (OPERATING-STANDARD §7 / #561): >80% confidence with exact line + concrete failure mode; HIGH/CRITICAL require the code path, a triggering input, and the wrong outcome — or demote; ZERO findings on clean work is a legitimate review.

## Output

Severity-ranked table (`CRITICAL|HIGH|MEDIUM|LOW`), each finding as `[SEVERITY] title — file:line — failure mode — suggested fix direction`. End with a verdict: Approve / Warning / Block.

## RStack governance routing

The verdict is advisory to the human and the pipeline: a formal validation still goes through `sdlc_validate`; approvals through `sdlc_approve`. This command writes NOTHING.