code-reviewlisted

Three-axis review of the diff between `HEAD` and a fixed point the user supplies: - **Risk** — is the code correct, safe, and adequately tested? - **Standards** — does the code conform to this repo's documented coding standards? - **Spec** — does the code faithfully implement the originating issue / spec? Each axis runs as a **parallel sub-agent** so they don't pollute each other's context. Findings are then verified, ranked by severity, and reported through `ReportFindings`. ## Process ### 1. Pin the fixed point Whatever the user said is the fixed point — a commit SHA, branch name, tag, `main`, `HEAD~5`, etc. If they didn't specify one, ask for it. Capture the diff command once: `git diff <fixed-point>...HEAD` (three-dot, so the comparison is against the merge-base). Also note the list of commits via `git log <fixed-point>..HEAD --oneline`. Before going further, confirm the fixed point resolves (`git rev-parse <fixed-point>`) and the diff is non-empty. A bad ref or empty diff should fail here — not inside three parallel sub-agents. ### 2. Score blast radius Blast radius sets review depth, not line count. A one-line middleware change outranks a 300-line rename. Score each changed file from `git diff --stat`: | Blast radius | Examples | Depth | |---|---|---| | **Critical** | Middleware, auth/authz, DB migrations, shared kernel, CI/CD, crypto, public contracts | Thorough — every code path | | **High** | Public API changes, message consumers, EF configuration, new modu