review-verification-protocol

# Review Verification Protocol

This protocol MUST be followed before reporting any code review finding. Skipping these steps leads to false positives that waste developer time and erode trust in reviews.

For Elixir/OTP/Phoenix/LiveView files, apply the gates below first; the issue-type and cross-stack sections apply when the reviewed code uses those stacks or patterns.

## Anti-confabulation (gate 0 — runs before every other gate)

Before issuing **any** verdict — flag, reject, or downgrade a finding — you MUST echo the exact artifact you are judging, quoted from a source you read in **this** turn:

- For a code finding: the **file:line** plus the cited code, read freshly now (not recalled from earlier in the session).
- For a diff review: the actual **diff hunk** under review.

> The artifact is the only source of truth. **Never** infer what you are reviewing from the branch name, the working directory, surrounding files, or recollection. If your mental model differs from the freshly read source, **the source wins.** A verdict issued without a same-turn echo of its target is invalid — emit the echo first, or do not emit the verdict.

This gate exists because an LLM under contextual priming will confidently flag code that is not in the file. It runs **before** the hard gates below.

## Hard gates (execute in order)

Do not report a finding until each relevant gate passes for **that** finding. A gate passes only when the pass condition is objectively satisfied (tool output, cited path:line), not when it “feels” verified.

1. **Read gate** — *Pass if:* you opened the full defining function, module section, or template region (or equivalent scoped read), not only the PR diff hunk for that symbol.
2. **Evidence gate** — *Pass if:* the finding cites `path:line` (or line range) that you can tie to actual file content from a read/search tool in this session.
3. **Usage gate** (before “unused”, “dead code”, “unreachable”) — *Pass if:* you ran a repo-wide reference search and can state the result (e.g. zero matches vs matches at listed paths); if the symbol may be invoked dynamically, *Pass if:* you checked reflection-like mechanisms (macros, `apply`, MFA strings, config) or explicitly mark uncertainty as a question, not a defect.
4. **Cross-cutting gate** (before “missing validation/error handling”) — *Pass if:* you checked at least one of caller, plug/pipeline, context, supervision, or framework guarantees, or you document that none apply.
5. **Severity gate** (before Critical/Major) — *Pass if:* you can name a concrete failure mode (what breaks, who is affected), not a style preference or hypothetical edge case.

If you cannot pass a gate, **omit the finding**, **downgrade** per [Severity Calibration](#severity-calibration), or **ask a question** instead of asserting a defect.

## Pre-Report Verification Checklist

Before flagging ANY issue, verify (maps to [Hard gates](#hard-gates-execute-in-order)):

- [ ] **Read gate** — Full symbol/region read, not diff-only
- [ ] **Evidence gate** — Citable `path:line` from tool-backed content
- [ ] **Usage gate** — Reference search (or dynamic-call check) before “unused”
- [ ] **Cross-cutting gate** — Validation/handling checked at other layers where relevant
- [ ] **Docs/syntax** — Verified against current framework/docs for the file’s stack (e.g. Tailwind v4, TS 5.x, React 19 when reviewing those files)
- [ ] **Style vs wrong** — Both approaches may be valid; distinguish
- [ ] **Intentional design** — Comments, CLAUDE.md, AGENTS.md, architectural context considered

## Verification by Issue Type

### "Unused Variable/Function"

**Before flagging**, you MUST:
1. Search for ALL references in the codebase (grep/find)
2. Check if it's exported and used by external consumers
3. Check if it's used via reflection, decorators, or dynamic dispatch
4. Verify it's not a callback passed to a framework

**Common false positives:**
- State setters in React (may trigger re-renders even if value appears unused)
- Variables used in templates/JSX
- Exports used by consuming packages

### "Missing Validation/Error Handling"

**Before flagging**, you MUST:
1. Check if validation exists at a higher level (caller, middleware, route handler)
2. Check if the framework provides validation (Pydantic, Zod, TypeScript)
3. Verify the "missing" check isn't present in a different form

**Common false positives:**
- Framework already validates (FastAPI + Pydantic, React Hook Form)
- Parent component validates before passing props
- Error boundary catches at higher level

### "Type Assertion/Unsafe Cast"

**Before flagging**, you MUST:
1. Confirm it's actually an assertion, not an annotation
2. Check if the type is narrowed by runtime checks before the point
3. Verify if framework guarantees the type (loader data, form data)

**Valid patterns often flagged incorrectly:**
```elixir
# Pattern matching, NOT type casting
%UserData{} = data = load_user()

# Guard clauses narrow the type safely
def process(%User{name: name} = user) do
  name  # Elixir knows this is a User struct
end
```

### "Potential Memory Leak/Race Condition"

**Before flagging**, you MUST:
1. Verify cleanup function is actually missing (not just in a different location)
2. Check if AbortController signal is checked after awaits
3. Confirm the component can actually unmount during the async operation

**Common false positives:**
- Cleanup exists in useEffect return
- Signal is checked (code reviewer missed it)
- Operation completes before unmount is possible

### "Performance Issue"

**Before flagging**, you MUST:
1. Confirm the code runs frequently enough to matter (render vs click handler)
2. Verify the optimization would have measurable impact
3. Check if the framework already optimizes this (React compiler, memoization)

**Do NOT flag:**
- Functions created in click handlers (runs once per click)
- Array methods on small arrays (< 100 items)
- Object creation in event handlers

## Severity Calibration

### Critic