# Common Review Policy

Define a repository review policy fixing what each review pass checks, how severities...

- Repository: https://github.com/HoangNguyen0403/agent-skills-standard (582 stars)
- Category: Engineering
- License: MIT
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add HoangNguyen0403/agent-skills-standard --skill common-review-policy -g -a claude-code -y`
Codex: `npx skills add HoangNguyen0403/agent-skills-standard --skill common-review-policy -g -a codex -y`
Cursor: `npx skills add HoangNguyen0403/agent-skills-standard --skill common-review-policy -g -a cursor -y`
Gemini CLI: `npx skills add HoangNguyen0403/agent-skills-standard --skill common-review-policy -g -a gemini-cli -y`

## Description

Define a repository review policy fixing what each review pass checks, how severities rank, which paths are skipped, the nit cap, and who approves. Use when review findings feel inconsistent or noisy, or when tuning an automated reviewer.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Review Policy Standard

## **Priority: P1 (HIGH)**

Every pull request gets the same passes in the same order. A review that varies by reviewer or by day is not a control.

## 1. The Policy File

- Location: `docs/review-policy.md`, tracked in the repository and reviewed like code.
- `code-review` and `review-ticket` load it when present; its severity and skip rules override their defaults.
- Owned by the technical lead. Absent the file, the workflow defaults apply and the review says so.
- Load `references/review-policy-template.md` when drafting or auditing the file.

## 2. Required Passes

Declare the passes and their order. Each pass names what it checks and what it explicitly ignores.

| Pass | Checks | Out of scope |
| --- | --- | --- |
| Correctness | logic, edge cases, requirement coverage | style |
| Security | injection, secrets, authorization, trust boundaries | theoretical risk with no path |
| Tests | new logic covered, failure paths asserted | coverage percentage targets |
| Compliance | audit, data classification, licence | product decisions |

## 3. Severity Ladder

- **Blocker**: merge causes a defect, breach, or data loss. Concrete path required.
- **Major**: real risk or requirement gap the author must resolve or explicitly accept.
- **Nit**: everything else, including style, naming, and preference. Minor and Suggestion collapse into Nit.
- **Confidence**: a finding without evidence is `needs validation`, never a silent drop and never a Blocker.
- One ladder per repository. Workflows that use a longer list map onto these three before publishing.

## 4. Noise Control

- **Skip list**: generated code, vendored dependencies, lockfiles, and snapshots. Name them as globs.
- **Nit cap**: a fixed maximum per review. Over the cap, keep the highest-signal nits and drop the rest.
- **Lead with risk**: Blocker and Major first, nits last, praise never.
- **Deduplicate by root cause**: one finding per cause, listing the affected locations.

The rest: https://github.com/HoangNguyen0403/agent-skills-standard/blob/HEAD/.codex/skills/common/common-review-policy/SKILL.md