review-codelisted

# Review Code Review-phase entry skill. Apply risk-appropriate review pressure to a finished change. Multi-axis read across correctness, security, performance, UI, and architecture, with adversarial review for high-risk diffs. ## Iron Rule <EXTREMELY-IMPORTANT> 1. NEVER merge code on a high-risk surface (auth, billing, payments, credits, migration, data deletion, secrets, tokens, crypto, permissions, security) without an adversarial fresh-context review. 2. NEVER let the author — or, for the adversarial pass, the author's own model — be the final reviewer of their own change. The external adversarial review runs on a model **family** different from the Lead's; the vertical fallback (same family, stronger tier) never satisfies it — it only upgrades the Lead floor and is recorded as a limitation. 3. NEVER skip review because "tests pass". Tests prove the assertion, not the design. 4. Findings before fixes. List issues with severity first; do not silently rewrite. 5. Author MUST verify findings against the codebase before implementing. No performative agreement ("you're absolutely right!", "great point!", "thanks!"). No blind implementation. Clarify all unclear items before partial implementation — findings may be linked. </EXTREMELY-IMPORTANT> ## When to use - Change is implementation-complete and verified - High-risk surface touched (auth / billing / payments / credits / migration / data deletion / secrets / tokens / crypto / permissions / security) - Public API or schema