chore: restore original directory structure (project under code-review-graph-main/)

code-review-graph-main/skills/project-review/references/specialists/api-contract.md

@@ -0,0 +1,13 @@
+# API Contract Specialist
+
+Focus: API and interface contract changes in the diff.
+
+- [ ] Breaking changes to public endpoints (paths, params, response shape)
+- [ ] Versioning compatibility (deprecations, fallbacks)
+- [ ] Request/response validation matches the schema
+- [ ] Error response shape is consistent
+- [ ] Authentication/authorization behavior unchanged for existing consumers
+- [ ] Renamed/moved functions: all callers updated
+
+Output JSON lines:
+`{"severity":"CRITICAL|INFORMATIONAL","confidence":N,"path":"file","line":N,"category":"api-contract","summary":"...","fix":"...","source":"api-contract"}`

code-review-graph-main/skills/project-review/references/specialists/data-migration.md

@@ -0,0 +1,15 @@
+# Data Migration Specialist
+
+Focus: database schema and data migrations in the diff.
+
+- [ ] Migration idempotent and re-runnable
+- [ ] Forward + rollback paths defined
+- [ ] Backfill batched / resumable
+- [ ] Type/precision changes do not truncate data
+- [ ] Nullability/default changes safe for existing rows
+- [ ] Application deploy compatible with old + new schema (expand/contract)
+
+Insurance specialist — always runs, even when silent.
+
+Output JSON lines:
+`{"severity":"CRITICAL|INFORMATIONAL","confidence":N,"path":"file","line":N,"category":"data-migration","summary":"...","fix":"...","source":"data-migration"}`

code-review-graph-main/skills/project-review/references/specialists/maintainability.md

@@ -0,0 +1,16 @@
+# Maintainability Specialist
+
+Focus: code quality and maintainability issues.
+
+- [ ] Dead code / unreachable branches / unused variables
+- [ ] Magic numbers → named constants
+- [ ] Overcomplicated abstractions (indirection without payoff)
+- [ ] Copy-paste blocks that should be shared (only when it aids clarity)
+- [ ] Functions too large / doing too much
+- [ ] Stale comments contradicting the code
+
+Suppress: harmless redundancy that aids readability, comment-on-threshold
+requests, consistency-only changes.
+
+Output JSON lines:
+`{"severity":"CRITICAL|INFORMATIONAL","confidence":N,"path":"file","line":N,"category":"maintainability","summary":"...","fix":"...","source":"maintainability"}`

code-review-graph-main/skills/project-review/references/specialists/performance.md

@@ -0,0 +1,14 @@
+# Performance Specialist
+
+Focus: performance and resource efficiency in the diff.
+
+- [ ] N+1 queries — missing eager loading
+- [ ] Unindexed lookups in hot loops
+- [ ] O(n×m) lookups in views/loops
+- [ ] Blocking calls in async paths (sync subprocess, requests, sleep)
+- [ ] Connection pool exhaustion, unbounded retries
+- [ ] Bundle/asset size regressions (frontend)
+- [ ] Redundant recomputation / missing caching
+
+Output JSON lines:
+`{"severity":"CRITICAL|INFORMATIONAL","confidence":N,"path":"file","line":N,"category":"performance","summary":"...","fix":"...","source":"performance"}`

code-review-graph-main/skills/project-review/references/specialists/red-team.md

@@ -0,0 +1,18 @@
+# Red Team Specialist (conditional)
+
+Focus: find what the primary and specialist reviewers MISSED. Only dispatched
+when the diff is large (>200 lines) or a specialist found a critical issue.
+
+Think like an attacker and a chaos engineer:
+
+- [ ] Cross-cutting concerns the specialist checklists do not cover
+- [ ] Integration boundary failures (service-to-service, module-to-module)
+- [ ] Failure modes: what breaks in production under load, restart, partial
+      failure
+- [ ] Silent data corruption paths (wrong results without errors)
+- [ ] Error handling that swallows failures
+- [ ] Trust boundary violations
+- [ ] Race conditions and edge cases the primary review missed
+
+Be adversarial. No compliments — just the problems. Tag findings with
+`"source":"red-team"`. Output `NO FINDINGS` when nothing new is found.

code-review-graph-main/skills/project-review/references/specialists/security.md

@@ -0,0 +1,17 @@
+# Security Specialist
+
+Focus: security vulnerabilities in the diff.
+
+- [ ] SQL injection (string interpolation, parameterized queries)
+- [ ] AuthN/AuthZ bypasses, missing permission checks
+- [ ] XSS (unsafe HTML rendering on user data)
+- [ ] Sensitive data exposure / missing masking in logs and responses
+- [ ] SSRF (fetching user/LLM-controlled URLs without allowlist)
+- [ ] Command injection (`shell=True` + interpolation)
+- [ ] Hardcoded secrets / credentials
+- [ ] CSRF / missing rate limiting on auth endpoints
+
+Insurance specialist — always runs, even when silent.
+
+Output JSON lines:
+`{"severity":"CRITICAL|INFORMATIONAL","confidence":N,"path":"file","line":N,"category":"security","summary":"...","fix":"...","source":"security"}`

code-review-graph-main/skills/project-review/references/specialists/testing.md

@@ -0,0 +1,14 @@
+# Testing Specialist
+
+Focus: test coverage gaps and tests that would catch the issues found.
+
+- [ ] Every changed function has at least a happy-path test
+- [ ] Negative/error paths tested (invalid input, failure branches)
+- [ ] Edge cases mirror the happy-path structure
+- [ ] If the fix for a finding can be caught by a test, propose a minimal
+      `test_stub` (framework-detected: jest/vitest/rspec/pytest/go-test)
+- [ ] Integration coverage for critical flows (DB, external calls)
+- [ ] No assertion-only tests that pass trivially
+
+Output JSON lines:
+`{"severity":"CRITICAL|INFORMATIONAL","confidence":N,"path":"file","line":N,"category":"testing","summary":"...","fix":"...","test_stub":"...","source":"testing"}`