For AI agents: the complete documentation index is available at https://docs.flezise.com/llms.txt, the full documentation bundle is available at https://docs.flezise.com/llms-full.txt, and this page is available as Markdown at https://docs.flezise.com/work-items/code-review.md.
Docs
  • 26.11

    • Code review

    Code review is an automated review of the builder agent's code change, applied to the diff after the deterministic quality gates (preflight, acceptance-criteria, and verifier) pass. It gives you a layered second opinion from narrow specialists before work reaches the human review step.

    What the reviewers check

    Four governed specialist agents inspect the diff in parallel, each restricted to one aspect.

    Security

    Injection (SQL, command, template, LDAP), hardcoded secrets, broken or missing authentication and authorization, unsafe deserialization, path traversal, SSRF, and weak or misused cryptography.

    Performance

    N+1 queries, super-linear work on hot paths, needless allocations and copies, synchronous I/O on async paths, missing pagination or caching, and unbounded memory growth.

    Quality

    Missing or swallowed error handling, resource leaks, dead code, unclear or misleading names, and unhandled edge cases in the changed logic.

    Requirement alignment

    Acceptance criteria the diff does not implement, behavior that contradicts the approved design, and code changes that go materially beyond what the story requested.

    A coordinator pass follows the parallel specialists. It deduplicates overlapping findings, filters false positives, and re-judges severity before the consolidated list is written.

    When code review runs

    Code review runs after the preflight, acceptance-criteria, and verifier gates pass and before the change is delivered to a branch. It is on by default.

    1. Implementation
    2. Quality gates
    3. Code review
    4. Delivery

    Review time grows with the change: 8 minutes plus about 15 seconds for each changed file, never more than 30 minutes, so the first build of a new project gets its whole diff reviewed. A review that cannot finish shows as skipped with the reason, and the build carries on without it.

    Every finding carries a severity (critical, high, warning, low, or suggestion), an aspect, and a file location where the reviewer can locate one. The consolidated list appears as an Automated code review comment on the work item.

    The correction turn

    By default, code review posts its findings as an informational comment and the gate chain continues regardless of the findings. The builder agent does not receive a separate fix prompt.

    When code_review_comments_only is disabled in the pipeline configuration, findings that reach critical severity trigger a single correction turn: the builder agent receives the blocking findings and addresses them before the gate chain runs. There is at most one correction round per implementation attempt.

    How this relates to human review

    Code review is not the human review step. After the gate chain passes and the change is delivered to a branch, you inspect the result on the work item's Overview tab and press Accept fix or Request changes in the Your review node. See Review a fix.

    Code review also does not replace the verifier agent's artifact review. Artifact review checks the content of specifications and designs for completeness and consistency. See Review findings.

    Next steps