Classifying Review Findings

Classifying Review Findings

Severity Categories

| Emoji | Category | Criteria |

| ----- | --------- | ------------------------------------------------------------------------------ |

| ❌ | CRITICAL | Will break, crash, expose data, or violate requirements |

| ⚠️ | IMPORTANT | Missing error handling, unhandled edge cases, could cause bugs |

| ♻️ | DEBT | Duplicates patterns, violates conventions, needs rework within 6 months |

| 🎨 | SUGGESTED | Measurably improves security, reduces complexity by 3+, eliminates bug classes |

| ❓ | QUESTION | Requires human knowledge - unclear requirements, intent, or system conflicts |

ALWAYS use hybrid emoji + text format for each finding (if multiple severities apply, use the most severe: ❌ > ⚠️ > ♻️ > 🎨 > ❓):

Before Classifying

Verify ALL three:

• Can you trace the execution path showing incorrect behavior?
• Is this handled elsewhere (error boundaries, middleware, validators)?
• Are you certain about framework behavior and language semantics?

If any answer is "no" or "unsure" → DO NOT classify as a finding.

Not Valid Findings (Reject)

• Praise ("great implementation")
• Vague suggestions ("could be simpler")
• Style preferences without enforced standard
• Naming nitpicks unless actively misleading
• PR metadata issues (title, description, test plan) - handled by summary skill, not classified here
• Renovate/Dependabot minor/patch updates to existing dependencies with passing CI — these are routine Stage 5 monitoring, not reviewable findings

Suggested Improvements (🎨) Criteria

Only suggest improvements that provide measurable value:

• Security gain - Eliminates entire vulnerability class (SQL injection, XSS, etc.)
• Complexity reduction - Reduces cyclomatic complexity by 3+, eliminates nesting level
• Bug prevention - Makes entire category of bugs impossible (type safety, null safety)
• Performance gain - Reduces O(n²) to O(n), eliminates N+1 queries (provide evidence)

Provide concrete metrics:

• ❌ "This could be simpler"
• ✅ "This has cyclomatic complexity of 12; extracting validation logic would reduce to 6"

If you can't measure the improvement, don't suggest it.