chore: add unified-review opencode command file

2026-08-05 13:59:05 +08:00
parent b96f38276f
commit 6f0e6f0775
1 changed files with 43 additions and 0 deletions
@@ -0,0 +1,43 @@
+---
+description: Run the three-layer unified review (CRG graph context + score_review + dedupe_findings + generate_report).
+agent: build
+---
+
+# Unified Review
+
+Run the three-layer unified code review using the MCP prompt workflow.
+
+$ARGUMENTS
+
+**Token optimization:** Before starting, call `get_docs_section_tool(section_name="unified-review")` for the optimized workflow.
+
+## Steps
+
+1. **Load the workflow** by calling the `unified_review` MCP prompt (or the `unified-review` skill). This drives the full READ-ONLY review pipeline.
+
+2. **Ensure the graph is current** by calling `build_or_update_graph_tool()`.
+
+3. **Get the review context** by calling `get_review_context_tool()` — changed files, blast radius, source snippets.
+
+4. **Detect changes** by calling `detect_changes_tool()` — risk score, changed functions, test gaps, affected flows.
+
+5. **Score objectively** by calling `score_review_tool()` — SQL risk, exception coverage, redundancy, high-risk density, vulnerability heuristic (good/warn/fail grades). LLM-judged metrics are in `llm_judged`.
+
+6. **Review the changed code** (Layer 1 chain decomposition): interface, business, data, utility, error handling, security, performance, observability. Produce findings with severity (blocker/major/minor), confidence (1-10), file:line, and proposed fix.
+
+7. **Merge findings** by calling `dedupe_findings_tool(findings=<your findings>)` — fingerprint dedup, multi-source confidence boost, PR quality score.
+
+8. **Generate the report** by calling `generate_report_tool(review_data=<verdict, tier, scope, metrics, merged findings>)` — writes `code-review-report.html`.
+
+9. **Report** the verdict (✅ PASS / ❌ FAIL), severity counts, each issue with confidence + fix, and manual-review items.
+
+## Important Rules
+
+- **READ-ONLY.** This workflow never modifies code, commits, or pushes. Every finding waits for a manual fix decision.
+- **Any blocker → verdict ❌ FAIL**, regardless of other scores.
+- Tier (fast / standard / strict) comes from `.code-review.yaml` at the repo root, or the `tier` argument.
+
+## Tips
+
+- For large diffs (50+ lines), dispatch specialist subagents (testing, maintainability, security, performance, data-migration, api-contract) in parallel before dedupe.
+- Security and data-migration are insurance specialists — always run even when silent.