name: review-backend
description: Backend-focused review (structure, modularization, hexagonal architecture, security, coding)
all_steps:
  rules:
    - ref: findings-handling
      position: before_instruction
    - ref: plain-terminology
      position: before_instruction

max_steps: 10
facet_pools:
  security-review-facets:
    uses: security-review-facets
initial_step: gather

steps:
  - name: gather
    uses: review-gather-to-reviewers
    rules:
      - condition: Review target information gathered
        next: reviewers
      - condition: Unable to identify review target, insufficient information
        next: ABORT

  - name: reviewers
    tags:
      - review
    parallel:
      fixed:
        - name: arch-review
          capabilities: readonly
          tags:
            - review
          edit: false
          persona: architecture-reviewer
          policy:
            - contract-change
            - review
            - architecture
            - backend
          knowledge:
            - architecture
            - backend
          instruction: review-arch
          output_contracts:
            report:
              - name: architect-review.md
                format: architecture-review
          rules:
            - condition: approved
            - condition: needs_fix

        - name: coding-review
          capabilities: readonly
          tags:
            - review
          edit: false
          persona: coding-reviewer
          policy:
            - contract-change
            - review
            - coding
          instruction: review-coding
          output_contracts:
            report:
              - name: coding-review.md
                format: coding-review
          rules:
            - condition: approved
            - condition: needs_fix

      pool:
        - name: security-review
          description: Do not select by default. Select only when (a) the change may affect secret or credential handling, external-input handling, process execution, filesystem operations, network or terminal boundaries, sandboxing, or permissions, or (b) the change is large enough that security impact cannot be confidently ruled out. Do not select for documentation-only, comment-only, or test-only changes, or small localized fixes.
          capabilities: readonly
          tags:
            - review
          edit: false
          persona: security-reviewer
          policy:
            - contract-change
            - security-review
          knowledge:
            - security
            - security-data
            - security-dependencies
          dynamic_facets:
            pool: security-review-facets
            selector:
              instruction: select-applicable-candidates
          instruction: review-security
          output_contracts:
            report:
              - name: security-review.md
                format: security-review
          rules:
            - condition: approved
            - condition: needs_fix
      selection:
        selector:
          instruction: select-applicable-candidates

    rules:
      - condition: any("error")
        next: reviewers
      - condition: all("approved")
        next: review-synthesis
      - condition: any("needs_fix")
        next: supervise

  - name: review-synthesis
    uses: review-synthesis-to-complete
    rules:
      - condition: BLOCKED
        next: ABORT
      - condition: APPROVE
        next: COMPLETE
      - condition: REJECT
        next: COMPLETE

  - name: supervise
    uses: review-supervise-to-complete
    rules:
      - condition: BLOCKED
        next: ABORT
      - condition: APPROVE
        next: COMPLETE
      - condition: REJECT
        next: COMPLETE