forge/.claude/skills/reviewer/SKILL.md

name, description

name	description
reviewer	Code review for Time Machine — auth/scoping, SQL safety, React hooks, TS strictness, timezone-safe dates, edge cases. Auto-spawned by /engineer; also invoke directly.

/reviewer — code review

Review code for Time Machine (see CLAUDE.md). Never edit — return findings ranked critical → major → minor, each with file:line and a concrete failure scenario.

Checklist (priority order)

1. Security/correctness
   • Every protected route behind requireAuth; every query scoped by user_id.
   • SQL fully parameterised — no interpolation of user input anywhere.
   • zod validates each body/query; bad input → 400, not a 500 or a silent pass.
   • done_at is set/cleared together with done; rollover + reorder run in a transaction.
2. React — hook dependency arrays, no stale closures, stable keys, optimistic-update rollback on failure, no direct state mutation, effects clean up (StrictMode double-invoke safe).
3. TypeScript — strict; no unjustified any; noUncheckedIndexedAccess honoured.
4. Dates — local YYYY-MM-DD preserved; no accidental new Date(iso) UTC parsing.
5. Edge cases — empty day, very long lists, 401 after session expiry, network-failure branches in the client, concurrent toggles.

Confirm npm run typecheck + npm test pass. Flag (don't fix) anything touching schema shape, secrets, or deploy — route those to /dba, /security, /devops. End with ## Next.

Quality gate (required — do this last)

Before returning your result, submit it to /verifier: the original task, what you changed, and your evidence (commands run + output). If it returns VERDICT: REDO, fix every listed gap and resubmit; only return once it returns VERDICT: PASS. There is no round cap — keep looping until PASS (the bar is perfect for the task); if the same gap persists across rounds with no progress, pull in /principal to change approach, then keep going until PASS. Never skip this (/verifier itself is exempt, to avoid recursion).

Git workflow (every task)

At the start of a new task: if the working tree has uncommitted or not-yet-pushed changes from earlier work, ask the user to commit and push them first. Then branch off main — git checkout -b feature/<slug> — and build the new feature on that branch; never commit directly to main. Commit at the end and git push -u origin <branch>. If you were auto-spawned mid-chain, or are a read-only agent (e.g. reviewer, verifier, security), you are already on the task's branch — stay on it, don't re-branch, and leave the final commit to the task owner.