bmad-bmm-code-review

Adversarial code review identifies specific security and robustness issues by loading a fixed internal workflow. You trigger it by instructing the AI to execute the designated code-review workflow, ensuring consistent findings and per-section output saving for traceability.

Adversarial code review is a deterministic process that applies strict workflow rules to find codebase issues. It functions by loading a configured workflow.yaml and executing prescribed steps, automatically saving outputs to preserve validation traceability.

Rigorous security validation before merge requires running a guided, deterministic code review. By enforcing a prescribed internal workflow, the review identifies vulnerabilities and ensures robustness checks are consistently applied to your code sample.

The code review workflow requires specific configuration files to run. It enforces a fixed workflow via {project-root}/_bmad/core/tasks/workflow.xml and the code-review workflow at {project-root}/_bmad/bmm/workflows/4-implementation/code-review/workflow.yaml.

Code analysis is triggered by explicit review commands such as "run code review" or when actively reviewing a code sample. This explicit activation ensures the strict adversarial workflow executes only when rigorous validation is required.

A fixed workflow for code analysis limits flexibility by enforcing prescribed steps and strict per-section output saving. This deterministic approach prioritizes consistency and traceability over adaptable, free-form code review strategies.