qa-review

Invoke $qa-review with the pull request as the target. It detects the PR base branch, gathers the full diff, runs four parallel review lanes, and returns a severity-ranked report of validated findings with file-and-line evidence.

Run $qa-review on the working tree; it starts with git status, git diff --stat, and git diff --cached --stat to cover both staged and unstaged changes. It records whether uncommitted changes are included and ignores unrelated pre-existing issues.

It covers four lanes: correctness (regressions, error handling, missing tests), security (auth, injection, secrets, trust boundaries), performance/build/runtime (hot paths, packaging, dependencies), and style/maintainability (conventions, superfluous helpers, test hygiene).

Yes, it discovers standard project checks from files like package.json, Makefile, pyproject.toml, Cargo.toml, and CI configuration, then runs non-fixing checks matching the changed surface and risk, reporting exact pass/fail commands.

Do not invoke it for ordinary coding tasks or change requests; it is designed only for explicit pre-merge review of diffs, branches, tickets, or pull requests. It activates only when the user directly asks for QA, validation, or merge-checking.