code-review assumes the code is broken and makes you prove it isn't — adversarial review that reports a failing test, a file:line defect, or NO ISSUES FOUND, and never fixes. It is an implementation of the good opinion applied to code: the standard that a change has to survive a hostile read. This discipline is the contract every reviewer returns against.

The primitives, all delivered.

Commands (operator-invoked):

Command	What it does
/code-review	Standalone adversarial review of a diff or PR.
/doubt	In-flight review of a decision before it stands.
/simplify	Cut accidental complexity, no behavior change.

Sub-agents (auto-dispatched during review):

• adversarial-reviewer — the in-process critic.
• adversarial-reviewer-cross — a cross-model second opinion (Gemini).
• security-auditor — boundary threat modeling.
• test-engineer — coverage audit.

Plus the evidence-tracker hook (fires in /work), the cross-review.sh script, and the security-review + testing-strategy skills.

Three operator-invoked commands + the auto-dispatched adversarial sub-agents + the evidence-tracker /work gate; every reviewer returns a falsifiable finding (prose rejected) — what good means concretely.

• /code-review — standalone adversarial review of a diff or PR (a commit range / branch / PR / URL, or the working-tree diff). It dispatches the cross-model reviewer first, then the in-process one for corroboration, and reports a failing test / DEFECT file:line / NO ISSUES FOUND; never fixes. Invoked by the operator, on demand — a standalone command, not part of a workflow.
• /doubt — in-flight review of a decision before it stands: CLAIM → EXTRACT → DOUBT → RECONCILE → STOP, with a hard 3-cycle cap. Catches a contract-misread or a wrong assumption before the code is written. Invoked by the operator, on demand.
• /simplify — cut accidental complexity (Chesterton's Fence — understand why code exists before removing it — + the Rule of 500); no behavior change; returns safe removals + Rule-of-500 flags for operator approval. Invoked by the operator, on demand.

• adversarial-reviewer — the in-process critic, framed "the code contains bugs, find them"; returns the three-form contract. Invoked automatically as part of the /review workflow (in development-lifecycle), and by /code-review.
• adversarial-reviewer-cross — a cross-model second opinion (Gemini, via cross-review.sh), graceful-fallback to the in-process reviewer when unavailable. Invoked automatically by /code-review first, and by /review when a cross-model pass is available.
• security-auditor — three-tier boundary threat modeling (LLM API / persistence / system execution) → VULNERABILITY file:line. Invoked by the security-review skill, or automatically by /review when security review is requested.
• test-engineer — Beyoncé-rule + prove-it coverage audit → MISSING-TEST. Invoked by the testing-strategy skill, or automatically by /review when a coverage review is requested.

Every reviewer returns one of three forms: a failing test · a DEFECT / VULNERABILITY / MISSING-TEST at file:line · NO ISSUES FOUND. Prose-only critiques are rejected. This is the discipline that makes the review trustworthy — it forces a finding you can act on or reproduce, not an opinion. It is also what good means, concretely.

A PreToolUse hook (shipped here, enforcing development-lifecycle's /work): it blocks a [ ] → [x] checkbox flip unless the task's verification evidence is present — default-fail, with a per-task **Evidence:** none — <rationale> opt-out. It keeps "done" honest. A plan is a file agentm lists among the project's plans — a task's tasks/<name>/plan.md in the vault — or a repo-local .harness/PLAN(-slug).md, which is gated by its shape alone. The hook asks agentm only when an edit would flip a checkbox, and fails closed when agentm is installed but gives no answer. Invoked automatically — the hook fires on every /work checkbox flip.

code-review implements good — the adversarial-review contract is what good looks like applied to code: a change has to survive a hostile read, and a finding has to be a falsifiable file:line, not an opinion. (The standard is hardwired in the reviewers — adversarial-reviewer.md declares opinions: [good] frontmatter as a self-provider binding, per the locked agentm opinion-registry consumer grammar: code-review IS the good opinion's implements: artifact, so it stays hardwired with no interpolation, and scripts/check-opinion-self-provider-drift.py (PLAN-opinion-consumer-grammar task 3, 2026-07-07) flags agentm's opinions/good.md stub if it drifts from this file's own prose. Full request-by-name resolution — opinion_request("good") at runtime — remains future registry work.)

• enhances development-lifecycle's review — /review dispatches the adversarial pass; the evidence-tracker hook gates /work.
• implements the good opinion (agentm Opinions) — the adversarial-review contract is what good looks like.
• composed by diagnostics (hypothesis verification — real bug, or an assumption?) and maintenance (a no-living-callers check on a removal).
• composes privacy's pii-scrubber on the cross-model path — the raw diff sent to an external model (Gemini → Google) is scrubbed before shell-out, or a pre-flight re-confirm fires on scrub-positive material; opting into a second opinion is not consent to ship a secret to a third party. [PENDING-IMPL] — the scrub is not yet wired into cross-review.sh.
• Points up at the crickets HLD; the requires/enhances mechanics are in crickets-composition.

• The good opinion is hardwired today, now declared + drift-checked — the three-form contract is embedded in the reviewers, and adversarial-reviewer.md's opinions: [good] frontmatter (PLAN-opinion-consumer-grammar task 3, 2026-07-07) makes the binding explicit + monitored (check-opinion-self-provider-drift.py) rather than silently implicit; requesting good by name (opinion_request) at runtime is still future registry work (the Opinions design). [PENDING-IMPL] — wire the request-by-name when the Opinion registry ships; until then the hardwired-but-declared contract is good.
• The cross-model reviewer depends on an external CLI (agy, serving Gemini — retargeted from the standalone gemini CLI in V8 proving Lane G, 2026-07-13, after Google discontinued it for individuals) — opt-in per invocation, editable to another model in cross-review.sh, and graceful-fallback to the in-process reviewer; not a hard dependency. Its answers take time: agy's print mode waits 180 s, and a code-diff review over about 50 KB of material outruns it, so the script degrades such material before calling agy (amendment 2026-09-13). It also crosses a trust boundary — the raw diff goes to a third-party model with no redaction today; composing privacy's pii-scrubber (Dependencies) closes it ([PENDING-IMPL]).
• The {domain}-review family is future scope — peer-review beyond code (design-review, doc-review) arrives as sibling plugins, not a bloated single one.
• Re-audit triggers: wire opinion_request("good") when the registry ships; add {domain}-review siblings when peer-review beyond code is needed.

• crickets src/code-review/ — commands (/code-review, /doubt, /simplify) · agents (adversarial-reviewer, adversarial-reviewer-cross, security-auditor, test-engineer) · evidence-tracker hook · cross-review.sh · skills (security-review, testing-strategy); declares [adversarial-review]
• Up / composes: crickets HLD · composition · agentm Opinions (good)

2026-09-22 — the evidence tracker gates a task's plan.md again (code-review 0.4.0; agentm-vault part 15, crickets task 100). Since the projects migration on 2026-09-16, a plan has lived at tasks/<name>/plan.md in the vault. The hook only recognized PLAN(-slug).md directly under a .harness or vault harness directory, so no [x] flip in a task had been gated since the move. A file is now a plan when agentm lists it (scripts/project_homes.py plans, over agentm's list-plans). A repo-local .harness/PLAN(-slug).md stays gated by its shape. agentm is asked only once an edit would flip a checkbox, so an ordinary Write spawns nothing. An installed agentm that gives no answer blocks the flip, because the gate is default-fail. Without agentm, only the repo-local shape is gated. Why not match tasks/*/plan.md by shape: crickets composes no project layout, and where a project keeps its tasks is agentm's answer. Re-audit if the extra call on a flip shows up in hook latency.

2026-09-13 — every fallback exit carries the marker, and material over a measured ceiling skips agy (code-review 0.3.4). The agentm plan 07 review ran cross-review.sh five times on 67–216 KB of material. Each run hit agy's 180 s print timeout, which agy meets by exiting 0 with nothing on stdout and a "print timeout" line on stderr. The script sent that stderr to /dev/null and printed no marker on that branch, so the review went same-model with nothing to relay. Every non-zero exit now goes through one degrade() that prints the marker as stdout's only line. A no-output reason carries agy's exit code, the seconds it ran and whether the timeout fired, and a timed-out partial answer degrades rather than passing validate(). Material over MAX_MATERIAL_BYTES (50,000) degrades before agy is called; CROSS_REVIEW_MAX_BYTES overrides it. The number is measured: with the script's framing and model, one call at a time, code-diff reviews took 112 s at 34 KB, 154 s at 50 KB, 197 s at 67 KB and 239 s at 130 KB, and one of eleven runs at 67 KB or more finished inside 180 s. Why not a ceiling at the smallest failure (67 KB): 50–67 KB is unmeasured, and a false block costs the caller a split while a false attempt costs the whole timeout. Why not raise the timeout instead: every uncensored review from 67 to 130 KB finished in 197–304 s, so a longer timeout would have rescued these runs, but it lengthens the wait before every fallback that /review and /code-review callers sit through; that is the operator's call, left open here. Re-audit trigger: the print timeout, the model or agy's timeout behavior changes, or a review under 50 KB runs out of time.

2026-07-13 — cross-model transport retargeted from gemini to agy (V8 proving Lane G). Google discontinued the standalone Gemini CLI for individuals ("migrate to the Antigravity suite of products"); cross-review.sh's call_gemini() became call_agy(), invoking agy -p ... --model "Gemini 3.1 Pro (High)" --print-timeout 180s. One real behavioral adaptation: agy -p does not append piped stdin to the prompt the way gemini -p did (confirmed live), so the review material is now concatenated directly into the -p argument string instead, with agy's own stdin explicitly closed. Architecture unchanged — output contract, single retry, exit-code semantics, and the CROSS-REVIEW-DEGRADED marker (now keyed on command -v agy) all carry over verbatim. Verified against a real cross-model review on a small planted-bug diff: agy returned a genuine failing test, exit 0, no degradation marker. Re-audit trigger: agy's CLI surface changes (flags, stdin handling, model-name strings), or Google ships a general-availability replacement for the discontinued Gemini CLI.

2026-07-07 — self-provider good binding declared + drift-checked (PLAN-opinion-consumer-grammar task 3). adversarial-reviewer.md gained opinions: [good] frontmatter — a self-provider binding under the locked agentm opinion-registry consumer grammar (code-review IS the good opinion's implements: artifact, so it stays hardwired with no interpolation). scripts/check-opinion-self-provider-drift.py now flags agentm's opinions/good.md stub if it drifts from this file's own prose (never the reverse). Updated "Opinions it consumes" and the hardwired-opinion risk bullet to reflect that the binding is now explicit and monitored, not silently implicit — full opinion_request("good") runtime resolution is unchanged, still [PENDING-IMPL]. Note for crickets-composition.md readers: this does not move code-review off composition's "still hardwired" list — a self-provider binding stays hardwired by design; only cross-plugin bindings (e.g. design→good) move to "interpolated." Re-audit trigger: opinion_request("good") ships at runtime, or the drift check's anchor list needs revision as this file's prose evolves.

2026-06-28 — lock-down sweep (operator review). Converted the structure mermaid to a house-style hand-SVG (diagrams/crickets-code-review.svg). Confirmed code-review is an implementation of good applied to code and the falsifiable-findings-only invariant (failing test / file:line / NO ISSUES; prose rejected). The folded ADR 0009 record and the newest-first log are unchanged. Locked as a v5–v8 guidepost.

2026-06-28 — compose pii-scrubber on the cross-model path (critique W9). Named privacy's pii-scrubber in Dependencies and flagged the trust-boundary in Risks: the raw diff shipped to the external model (Gemini → Google) is scrubbed before shell-out, or a pre-flight re-confirm fires on scrub-positive material — [PENDING-IMPL] in cross-review.sh. Re-audit: wire the scrub before the cross-model path ships on by default.

2026-06-24 (re-homed 2026-06-25) — folded ADR 0009 (evidence-tracker hook) into this design. Originally folded into developer-safety in AG Phase 4; re-homed here (the correct owner — the hook ships in src/code-review/) in the AG settle-sweep Group E.

0009 — Evidence-tracker hook (2026-05-22). evidence-tracker ships as a PreToolUse hook with a default-FAIL contract: the agent must demonstrably Read a spec/test/evidence file matching the task requirement before any Write/Edit flipping a PLAN.md checkbox [ ]→[x]. Hybrid evidence resolution: heuristic (test-dir/test-file patterns, code-ext only) + per-task **Evidence:** <glob> override + **Evidence:** none — <rationale> opt-out. Why not pure heuristic: rejects tasks with non-test-shaped evidence. Why not per-task-only: forces annotating every task. features.json gating rejected as redundant with /release-time adversarial review. Re-audit triggers: Antigravity gains a file-based hook surface; PLAN.md task-header shape changes; Bash-read evidence becomes common enough to warrant extending; verification-quality grading becomes needed.

2026-06-23 — added the structure diagram (diagram backfill). Per the every-design-carries-a-diagram rule.

2026-06-23 — authored from the seeded stub (grounded against the live src/code-review plugin); revised on operator review. All primitives delivered — three operator-invoked commands (/code-review, /doubt, /simplify), four auto-dispatched adversarial sub-agents (incl. the cross-model variant), the evidence-tracker /work gate, two skills, cross-review.sh. Named the central invariant — falsifiable findings only (a failing test / file:line defect / NO ISSUES; prose rejected) — which is what good means concretely; added an Opinions-it-consumes clause (implements good). Operator review: framed it as an implementation of good applied to code; listed the commands as a table + the sub-agents individually; and made invocation plain (operator-invoked commands vs auto-dispatched agents/hook, each naming its workflow). Kept the name (the review-workflows rename was rejected). Designed-not-built: the good request-by-name (Phase-3/4, [PENDING-IMPL]) and the {domain}-review family. Re-audit: wire opinion_request("good"); add review siblings when needed.