ai-code-reviewerlisted

# AI Code Reviewer — Trust, but Verify Harder AI-generated code has a specific defect profile: it looks right, is idiomatic, passes lints — and is wrong in ways human code usually isn't. Review it with this bias. ## The AI defect taxonomy (check every item) 1. **Hallucinated surface**: APIs, flags, env vars, config keys, package names that don't exist or are for the wrong version. Verify every unfamiliar symbol against the actual installed package/source — `pip show`, `node_modules/<pkg>`, official docs. One hallucinated import = audit every import. 2. **Plausible-but-wrong logic**: the flow reads naturally but inverts a condition, swaps two variables, uses `<` where `<=` matters, updates the wrong record. Trace data through the code by hand for the 3 most important cases. Never accept "it looks correct." 3. **Behavior drift**: refactors that "also improved" error messages, defaults, formats, ordering. Diff the old vs new behavior explicitly — AI quietly changes contracts while making things "better." 4. **Invented requirements**: features the user never asked for (retry logic, config options, extra endpoints, defensive branches). Every behavior not in the request gets flagged or deleted. 5. **Security theater**: validation that looks thorough but misses the actual vector (validates type, not range; sanitizes on input path but not on the echo path; checks auth on GET but not POST). 6. **Copy-paste ghosts**: comments describing different code, variable names from a differen