code-review-and-quality

Review AI-generated code across five axes: correctness, readability, architecture, security, and performance. Check that tests verify behavior rather than implementation details, validate input handling at system boundaries, and never assume generated code is correct without evidence.

A thorough checklist covers correctness (edge cases, error paths), readability (naming, control flow), architecture (module boundaries, dependency direction), security (input validation, secrets, parameterized queries), and performance (N+1 queries, unbounded loops, pagination).

Around 100 lines changed is reviewable in one sitting, and 300 lines is acceptable for a single logical change. Changes near 1000 lines should be split using stacking, file-group, horizontal, or vertical splitting strategies.

A review blocks merge when Critical findings exist, such as security vulnerabilities, correctness defects, or missing regression tests for bug fixes. Minor issues labeled Nit, Optional, or FYI should not block approval if the change improves overall code health.

Passing tests do not catch architecture violations, security flaws, readability debt, or missing edge-case coverage. Tests may also verify implementation details rather than behavior, giving false confidence in the change.