review-aggregation

Review Aggregation Skill

This skill provides guidance on how to effectively combine and prioritize findings from multiple code review agents.

When to Use

Apply this skill when:

• Running the extended review pipeline (/extended-review)
• The senior-engineer agent is synthesizing findings
• You need to prioritize issues from multiple sources
• Creating a final review summary

Aggregation Process

1. Collect All Findings

Gather outputs from all review agents:

2. Deduplicate Findings

Multiple agents may flag the same issue:

• Same file + line + concept = Merge into single finding
• Same concept, different locations = Keep separate, note pattern
• Related but distinct issues = Keep separate, cross-reference

3. Apply Priority Matrix

Use this matrix to assign final priority:

4. Identify Patterns

Look for systemic issues:

Pattern Detection Checklist:
- [ ] Same issue in 3+ locations = Systemic problem
- [ ] Multiple agents flag same area = High-risk zone
- [ ] Test issues + code issues together = Likely bug
- [ ] Similar mistakes across files = Missing guidance/tooling

5. Structure Final Report

## Review Summary

### At a Glance

- Files reviewed: X
- Total issues: Y (P0: A, P1: B, P2: C, P3: D)
- Recommendation: [APPROVE / APPROVE WITH FIXES / REQUEST CHANGES]

### Critical Path (P0-P1)

These MUST be addressed before merge:

1. [Issue] in `file:line` - [Brief reason why critical]
2. [Issue] in `file:line` - [Brief reason why critical]

### Important (P2)

Should address, can track as follow-up:

1. [Issue] in `file:line`
2. [Issue] in `file:line`

### Improvements (P3)

Nice-to-have for future cleanup:

1. [Issue] in `file:line`
2. [Issue] in `file:line`

### Patterns Detected

[Any systemic issues that need broader attention]

### What's Done Well

[Positive observations to reinforce good patterns]

Cross-Reference Guidelines

When the same area has issues from multiple agents:

Example: Auth Handler Issues

┌─────────────────────────────────────────────────────┐
│ src/api/auth.ts:45-67                               │
├─────────────────────────────────────────────────────┤
│ code-reviewer: Missing input validation              │
│ silent-failure-hunter: Empty catch block             │
│ cruft-detector: Comment describes "what" not "why"   │
│ context7: Using deprecated bcrypt.hash() pattern     │
├─────────────────────────────────────────────────────┤
│ AGGREGATED: P0 - Auth handler has multiple issues   │
│ - Security: input validation + deprecated API (P0)  │
│ - Reliability: silent failure (P1)                  │
│ - Quality: poor comment (P3)                        │
│                                                     │
│ Recommendation: Rewrite this handler entirely       │
└─────────────────────────────────────────────────────┘

Escalation Rules

Automatic P0 Escalation

Escalate to P0 regardless of individual agent rating when:

• Security + silent failure in same code path
• Auth/payment code with any P1+ issue
• Test coverage is 0% for changed code
• Breaking API contract

Downgrade Conditions

Consider downgrading when:

• Issue is in test/example code only
• Issue is in clearly marked deprecated code being removed
• Change is behind feature flag (still track for flag removal)

Environment-Specific Notes

Claude Code

Full aggregation happens automatically via hooks:

1. pr-review-toolkit agents complete
2. chain-extended-review.sh triggers
3. Extended agents run
4. senior-engineer synthesizes

VS Code / OpenCode

Manual aggregation - guide user through:

1. "Run each review agent"
2. "Collect outputs"
3. "Apply priority matrix"
4. "Create summary"

Tips for Effective Aggregation

1. Don't double-penalize - If two agents flag same issue, count once
2. Context matters - Same issue may be P1 in core code, P3 in utils
3. Err toward shipping - When in doubt, track as follow-up vs blocking
4. Test issues are serious - False confidence from bad tests is dangerous
5. Security is absolute - Never downgrade security issues