---
description: Run the three-layer unified review (CRG graph context + score_review + dedupe_findings + generate_report).
agent: build
---

# Unified Review

Run the three-layer unified code review using the MCP prompt workflow.

$ARGUMENTS

**Token optimization:** Before starting, call `get_docs_section_tool(section_name="unified-review")` for the optimized workflow.

## Steps

1. **Load the workflow** by calling the `unified_review` MCP prompt (or the `unified-review` skill). This drives the full READ-ONLY review pipeline.

2. **Ensure the graph is current** by calling `build_or_update_graph_tool()`.

3. **Get the review context** by calling `get_review_context_tool()` — changed files, blast radius, source snippets.

4. **Detect changes** by calling `detect_changes_tool()` — risk score, changed functions, test gaps, affected flows.

5. **Score objectively** by calling `score_review_tool()` — SQL risk, exception coverage, redundancy, high-risk density, vulnerability heuristic (good/warn/fail grades). LLM-judged metrics are in `llm_judged`.

6. **Review the changed code** (Layer 1 chain decomposition): interface, business, data, utility, error handling, security, performance, observability. Produce findings with severity (blocker/major/minor), confidence (1-10), file:line, and proposed fix.

7. **Merge findings** by calling `dedupe_findings_tool(findings=<your findings>)` — fingerprint dedup, multi-source confidence boost, PR quality score.

8. **Generate the report** by calling `generate_report_tool(review_data=<verdict, tier, scope, metrics, merged findings>)` — writes `code-review-report.html` and `code-review-report.md` (default `format="both"`).

9. **Report** the verdict (✅ PASS / ❌ FAIL), severity counts, each issue with confidence + fix, and manual-review items.

## Important Rules

- **READ-ONLY.** This workflow never modifies code, commits, or pushes. Every finding waits for a manual fix decision.
- **Any blocker → verdict ❌ FAIL**, regardless of other scores.
- Tier (fast / standard / strict) comes from `.code-review.yaml` at the repo root, or the `tier` argument.

## Tips

- For large diffs (50+ lines), dispatch specialist subagents (testing, maintainability, security, performance, data-migration, api-contract) in parallel before dedupe.
- Security and data-migration are insurance specialists — always run even when silent.