For AI agents: the complete documentation index is available at https://docs.flezise.com/26.09/llms.txt, the full documentation bundle is available at https://docs.flezise.com/26.09/llms-full.txt, and this page is available as Markdown at https://docs.flezise.com/26.09/work-items/code-review.md.
Docs
  • 26.09

    • Code review

    Code review is an automated review of the builder agent's code change, applied to the diff before the deterministic quality gates execute. It gives you a layered second opinion from narrow specialists before work reaches the human review step.

    What the reviewers check

    Four governed specialist agents inspect the diff in parallel, each restricted to one aspect.

    Security

    Injection (SQL, command, template, LDAP), hardcoded secrets, broken or missing authentication and authorization, unsafe deserialization, path traversal, SSRF, and weak or misused cryptography.

    Performance

    N+1 queries, super-linear work on hot paths, needless allocations and copies, synchronous I/O on async paths, missing pagination or caching, and unbounded memory growth.

    Quality

    Missing or swallowed error handling, resource leaks, dead code, unclear or misleading names, and unhandled edge cases in the changed logic.

    Requirement alignment

    Acceptance criteria the diff does not implement, behavior that contradicts the approved design, and code changes that go materially beyond what the story requested.

    A coordinator pass follows the parallel specialists. It deduplicates overlapping findings, filters false positives, and re-judges severity before the consolidated list is written.

    When code review runs

    Code review runs after the builder agent commits its implementation and before the preflight, acceptance-criteria, and TDD gates. It is on by default.

    1. Implementation
    2. Code review
    3. Quality gates
    4. Delivery

    Every finding carries a severity (critical, high, warning, low, or suggestion), an aspect, and a file location where the reviewer can locate one. The consolidated list appears as an Automated code review comment on the work item.

    The correction turn

    By default, code review posts its findings as an informational comment and the gate chain continues regardless of the findings. The builder agent does not receive a separate fix prompt.

    When code_review_comments_only is disabled in the pipeline configuration, findings that reach critical severity trigger a single correction turn: the builder agent receives the blocking findings and addresses them before the gate chain runs. There is at most one correction round per implementation attempt.

    How this relates to human review

    Code review is not the human review step. After the gate chain passes and the change is delivered to a branch, you inspect the result on the work item's Atlas finished panel and press Accept fix or Request changes. See Review a fix.

    Code review also does not replace the verifier agent's artifact review. Artifact review checks the content of specifications and designs for completeness and consistency. See Review findings.

    Next steps