pr-review-evidence-formats

Standardize PR evidence by applying mandatory formats: Code Snippet (file:line with context), Execution Trace (step-by-step code flow), Exploitation Scenario (security proof with impact), and Test Result (before/after outcomes). Each format enforces Show Don't Tell, Reproducible Evidence, and Minimal Sufficient Context principles to ensure findings are verifiable across codebases.

A code snippet must include the file path and line number, surrounding context for clarity, and a description of the issue. This format ensures reviewers can locate, understand, and reproduce the finding without additional investigation.

Use execution traces when you need to demonstrate step-by-step code flow or behavior. Traces document the exact sequence through the codebase, making complex logic transparent and enabling reviewers to verify claims about how code executes.

Exploitation scenarios present security findings as proof-of-concept demonstrations with measurable impact. They go beyond identifying a vulnerability to show how it can be exploited, making the risk concrete and reproducible for reviewers.

Test results provide before/after proof that validates fixes or demonstrates problems. Unlike code snippets or traces, test results quantify outcomes, making them essential for verifying that changes actually resolve the reported issue.

Yes. The standardized formats apply to both security and quality reviews. Code snippets, traces, scenarios, and test results work for any PR finding that requires reproducible, verifiable evidence.