Code review contract

Authors prepare

• A description that states the goal and the user-visible behavior change.
• Tests covering the new behavior, not just the happy path.
• A self-reviewed diff: no stray files, no commented-out code, no TODOs without tickets.

Reviewers check in order

1. Correctness of the core logic.
2. Security: input handling, auth boundaries, secrets.
3. Tests that would fail if the feature broke.
4. Readability and consistency with neighboring code.

Comments state the problem and the reason; suggested fixes are welcome but the author applies them. Approval means "I would defend this in production".

Agent-generated code

Review it exactly like human code, plus one rule: demand provenance for any non-obvious claim. If the agent says "this matches our convention", the cited convention document should actually say that. Uncited convention claims are treated as unverified and checked manually.