code-review-patterns

Two-stage code review enforces spec compliance verification first, then quality assessment. Stage 1 validates behavior against requirements and edge cases; Stage 2 applies security, performance, and maintainability checklists only after Stage 1 passes, ensuring traceable, requirement-driven evaluation.

Stage 1 spec compliance review verifies that code submissions meet functional requirements, handle edge cases correctly, include adequate tests, and align with the specification. This gates progression to quality assessment and prevents quality reviews from proceeding on non-compliant code.

Security review focuses on input validation, authentication and authorization mechanisms, secrets management, and other vulnerabilities. This checklist runs as part of Stage 2 quality assessment after spec compliance passes, ensuring security flaws don't block functional verification.

Yes, two-stage review applies across code submissions including pull requests and patches. The spec-first methodology gates Stage 2 quality checks on Stage 1 compliance success, maintaining consistent evaluation regardless of submission type.

Verifying spec compliance first prevents quality reviewers from assessing maintainability, performance, or security on code that doesn't meet requirements. This sequencing ensures functional correctness precedes optimization, reducing rework and focusing review effort efficiently.

Stage 2 quality review assesses correctness, performance, maintainability, user experience, and accessibility alongside security. These attributes are evaluated only after Stage 1 spec compliance passes, ensuring comprehensive quality across all dimensions.