┌─────────────────────────────────────────────────────────────────────────┐
│                      CODE REVIEW FRAMEWORK                               │
├─────────────────────────────────────────────────────────────────────────┤
│                                                                         │
│  ┌────────────┐  ┌────────────┐  ┌────────────┐  ┌────────────┐        │
│  │ CORRECTNESS│  │  SECURITY  │  │   QUALITY  │  │  PATTERNS  │        │
│  └────────────┘  └────────────┘  └────────────┘  └────────────┘        │
│       │               │               │               │                 │
│       ▼               ▼               ▼               ▼                 │
│   • Logic bugs    • Injection     • Readability   • AGENTS.md          │
│   • Edge cases    • Auth/Authz    • Maintainable  • Conventions        │
│   • Regressions   • Data exposure • Performance   • Consistency        │
│                                                                         │
│  ┌──────────────────────────────────────────────────────────────┐      │
│  │                    SEVERITY RATINGS                           │      │
│  │  P0: Critical  |  P1: Important  |  P2: Nice-to-have         │      │
│  └──────────────────────────────────────────────────────────────┘      │
│                                                                         │
└─────────────────────────────────────────────────────────────────────────┘

□ Business Logic
  - Does code implement requirements correctly?
  - Are calculations accurate?
  - Are conditions/branching correct?

□ Edge Cases
  - Null/empty handling
  - Boundary conditions
  - Error states

□ State Management
  - State transitions correct?
  - No stale state issues?
  - Proper initialization?

□ Async Operations
  - Race conditions?
  - Proper await usage?
  - Error propagation?

□ Input Validation
  - All user inputs validated?
  - No injection vulnerabilities?
  - Proper sanitization?

□ Authentication & Authorization
  - Auth checks in place?
  - Proper permission checks?
  - Session handling?

□ Data Protection
  - Sensitive data not exposed?
  - Proper encryption?
  - No hardcoded secrets?

□ API Security
  - Proper error messages (no info leak)?
  - Rate limiting consideration?
  - HTTPS enforced?

□ Readability
  - Clear naming?
  - Reasonable function length?
  - Comments where needed?

□ Maintainability
  - Single responsibility?
  - No code duplication?
  - Testable design?

□ Performance
  - No unnecessary operations?
  - Proper list handling?
  - Widget rebuild optimization?

□ Error Handling
  - All errors caught?
  - Meaningful error messages?
  - Proper recovery?

□ State Management
  - Using StateNotifier correctly?
  - State class has copyWith?
  - Provider properly defined?

□ Models
  - Using Equatable?
  - Using ReturnValue for JSON?
  - Has props override?

□ Styling
  - Using TypographyTheme?
  - Using ColorApp?
  - Using Gap/SizeApp?

□ Widget Structure
  - Separate widget classes?
  - No _buildX methods?
  - ConsumerWidget where needed?

□ File Organization
  - Correct folder structure?
  - Proper file naming?
  - Correct layer separation?

□ Unit Tests
  - Critical logic tested?
  - Edge cases covered?
  - Error paths tested?

□ Widget Tests
  - UI states tested?
  - User interactions tested?

□ Mock Usage
  - Proper mocking?
  - No real API calls in tests?

1. Identify files to review
   - New files created
   - Modified files
   - Related test files

2. Load context
   - AGENTS.md patterns
   - Original requirements (if available)
   - Related existing code

For each file:
  1. Read through completely
  2. Check correctness
  3. Check security
  4. Check quality
  5. Check patterns
  6. Note all findings

For each finding:
  1. Assign severity (P0/P1/P2)
  2. Identify category
  3. Provide specific location
  4. Explain the issue
  5. Suggest fix

Compile findings into structured report:
  - Executive summary
  - Findings by severity
  - Findings by category
  - Recommendations

□ Widget Rebuilds
  - Const constructors where possible?
  - Keys used appropriately?
  - No expensive operations in build()?

□ Async/Await
  - Proper Future handling?
  - No fire-and-forget without intent?
  - Cancellation handled?

□ Null Safety
  - Proper null checks?
  - No unnecessary null assertions (!)?
  - Late variables justified?

□ Memory Leaks
  - Listeners disposed?
  - Controllers disposed?
  - Streams closed?

□ Provider Definition
  - Correct provider type?
  - Proper scoping?
  - No circular dependencies?

□ State Updates
  - Using copyWith correctly?
  - No direct state mutation?
  - Proper AsyncValue handling?

□ Ref Usage
  - Using read vs watch correctly?
  - No ref in async callbacks?

□ Response Handling
  - All fields mapped?
  - ReturnValue used correctly?
  - Error responses handled?

□ Request Building
  - Proper parameters?
  - Headers correct?
  - Body formatted correctly?

# Code Review: {Feature/PR Name}

## Metadata
- **Date**: {YYYY-MM-DD}
- **Files Reviewed**: {count}
- **Reviewer**: Claude Code / Codex CLI

---

## Executive Summary

| Severity | Count | Status |
|----------|-------|--------|
| P0 (Critical) | {X} | {BLOCKING/CLEAR} |
| P1 (Important) | {X} | |
| P2 (Nice-to-have) | {X} | |

**Verdict**: {APPROVE / REQUEST CHANGES / NEEDS DISCUSSION}

---

## P0 - Critical Issues

{If none: "No critical issues found."}

### P0-1: {Issue Title}

**File**: `path/to/file.dart`
**Line**: {line number}
**Category**: {Security/Correctness/etc.}

**Issue**:
{Description of the problem}

**Code**:
```dart
// Current code
{problematic code}

// Fixed code
{corrected code}

---

## Prompt

When user invokes `/code-review`, execute:

---

## Quick Commands