# Code Review Standards

> This document defines the AI code review rules for MetaDrivenPlatform4AI. All AI Reviews must strictly follow this standard.

---

## 1. Review Triggers

| Scenario | Trigger |
|----------|---------|
| PR created (opened) | ✅ Auto-trigger |
| PR updated (synchronize) | ✅ Auto-trigger |
| PR reopened (reopened) | ✅ Auto-trigger |
| @-mention bot | ✅ Auto-trigger |

---

## 2. Review Decision Criteria

### 2.1 Approve Conditions

**PR can only be Approved when ALL Critical issues are resolved.**

### 2.2 Issue Severity Levels

| Level | Description | Action |
|-------|-------------|--------|
| **CRITICAL** | System crash, data loss, security vulnerabilities, severe bugs | Must fix, block merge |
| **HIGH** | Functional errors, performance issues, serious code smells | Strongly recommend fix |
| **MEDIUM** | Code improvements, missing comments, suboptimal implementation | Recommended fix |
| **LOW** | Formatting issues, naming suggestions, code style | Optional fix |

---

## 3. Critical Issues Checklist

The following issues must block merge if found:

### 3.1 Security
- [ ] SQL injection vulnerability
- [ ] Unauthorized access (missing permission check)
- [ ] Sensitive data exposure (hardcoded tokens, passwords, secrets)
- [ ] XSS (Cross-Site Scripting)
- [ ] CSRF (Cross-Site Request Forgery)
- [ ] Privilege escalation (data isolation issues)

### 3.2 Correctness
- [ ] Null pointer dereference (NPE)
- [ ] Array out of bounds
- [ ] Resource leak (unclosed files/connections/database)
- [ ] Infinite loop or recursion
- [ ] Race condition
- [ ] Data race

### 3.3 Functionality
- [ ] Logic errors (inconsistent with requirements)
- [ ] Missing or improper error handling
- [ ] Edge cases not handled
- [ ] API contract violation (interface incompatibility)

### 3.4 Breaking Changes
- [ ] Removed necessary tests
- [ ] Broke existing functionality
- [ ] Removed security mechanisms
- [ ] Database migration causing data loss

---

## 4. Review Process

### 4.1 Review Preparation
1. Get PR title, description, author info
2. Get full diff of the PR
3. Checkout complete source code of base branch and PR branch
4. Identify modified files and their related files

### 4.2 Deep Review
1. **Change Analysis**: Understand purpose and logic of changes
2. **Context Analysis**: Impact of changes on the entire codebase
3. **Security Scan**: Check for vulnerabilities
4. **Correctness Verification**: Check logic errors and edge cases
5. **Impact Assessment**: Whether changes will break existing functionality

### 4.3 Review Output Format

```
## AI Code Review Summary

### PR Info
- **Title**: [title]
- **Author**: [author]
- **Branches**: [head] → [base]
- **Files**: N files changed

### Issues Summary

#### 🔴 CRITICAL (Must Fix)
[List all Critical issues]

#### 🟠 HIGH (Strongly Recommend)
[List all High issues]

#### 🟡 MEDIUM (Recommended)
[List all Medium issues]

#### 🔵 LOW (Optional)
[List all Low issues]

### Verdict
- [ ] **APPROVE** - No Critical issues, safe to merge
- [ ] **REQUEST_CHANGES** - Critical issues exist, must fix and re-review

---
*Reviewed by Hermes Agent - MetaDrivenPlatform4AI Review Bot*
```

---

## 5. Approve Rules

### 5.1 Conditions for Approval
- ✅ No CRITICAL issues
- ✅ All High issues are fixed or have reasonable explanation

### 5.2 Must Request Changes
- ❌ Any CRITICAL issues present
- ❌ Unresolved security vulnerabilities
- ❌ Changes that would break existing functionality

---

## 6. Reviewer Guidelines

### 6.1 Should Do
- ✅ Fully understand PR purpose and context
- ✅ Check interaction between changes and existing code
- ✅ Consider edge cases and exceptions
- ✅ Provide specific, actionable fix suggestions
- ✅ Maintain objective, professional review attitude

### 6.2 Should NOT Do
- ❌ Only look at diff, ignore complete context
- ❌ Only check surface issues, ignore deep logic
- ❌ Compromise on security and Critical issues
- ❌ Use vague, useless comments (e.g., "LGTM")
- ❌ Make final merge decisions for Human Review

---

## 7. Collaboration with Human Review

**Important Disclaimer**:
- AI Review is an auxiliary tool, cannot replace Human Review
- AI Approve only indicates code passed automated review
- Final merge still requires human review and confirmation
- Human Reviewer has final decision authority

---

## 8. Review Quality Assurance

### 8.1 Dual Model Review
To improve review quality, dual model review can be enabled:
- **Primary Model (Claude)**: Comprehensive check of correctness, security, maintainability
- **Adversarial Model (Codex)**: Adversarial challenge, find potential vulnerabilities

### 8.2 Review Records
- All Reviews are saved as GitHub PR comments
- Review verdict updates PR status

---

*Last Updated: 2026-04-15*
*Maintainers: MetaDrivenPlatform4AI Team*