code-reviewlisted

# Code Review Correctness and security gate. High-conviction findings only — flag issues you are certain about. Ambiguity defaults to "request changes." Structural concerns (cohesion, abstraction altitude, circular deps, dead code) belong to the `structural-review` skill; trust it on those axes and own correctness + security here. Stack rules from the repo's agent instruction file (Bun, Tailwind v4, Next.js 16, shadcn/ui) are validated by the correctness review harness's rule-compliance layer. Do not re-flag them here. ## Contract Inputs: - A single diff, branch, or PR to review. Read-only `git`/`gh` commands gather scope. Outputs: - A findings list bucketed into Block Merge / Request Changes / Approve, each with file, line, and a one-sentence rationale. - A **Spec** report alongside the checklist: missing requirements, scope creep, and wrong implementations relative to the originating issue. Keep the two axes separate so one cannot mask the other. Creates/Modifies: - None. This skill reports; it does not edit files or open PRs. External Side Effects: - Read-only `git` and `gh` invocations only. No mutations, no deploys. Confirmation Required: - None. All output is advisory. Delegates To: - `structural-review` for cohesion/abstraction/dead-code axes. - `security-audit` for OWASP-depth security review. - `codebase-design` when a finding is about module depth or seam placement. ## Spec Axis The checklist below is the **Standards** axis (correctness + se