---
name: step-05-deep-review
description: Adversarial code review of changes — find issues before they reach production
model: opus
prev_step: steps/step-04-examine.md
next_step: steps/step-06-resolve.md
---

# Step 5: Deep Review (if -x)

**Goal:** Review the code as an adversarial external reviewer. Find bugs, security issues, and convention violations that the automated eXamine checks (step-04) missed.

---

## 1. Gather Changed Files

```bash
git diff --name-only HEAD~{commit_count}
```

List all files modified during this APEX session.

---

## 2. MCP Code Review

```
Call: mcp__smartstack__review_code
  scope: "changed"      # Only review files changed in this session

Call: mcp__smartstack__analyze_code_quality
  scope: "changed"
```

---

## 3. Manual Adversarial Review

For each changed file, check:

**Security (OWASP):**
- [ ] `[RequirePermission]` on every endpoint (not `[Authorize]`)
- [ ] No SQL injection (parameterized queries, EF Core only)
- [ ] No XSS (React auto-escapes, but check dangerouslySetInnerHTML)
- [ ] Multi-tenant isolation (IHasData filter applied)
- [ ] No secrets in code

**Architecture:**
- [ ] Entities in correct Domain folder
- [ ] Configs in correct Infrastructure folder
- [ ] Services follow CQRS pattern
- [ ] DTOs separate from domain entities
- [ ] Controllers return DTOs, not entities
- [ ] Frontend in correct hierarchy (App/Module)

**SmartStack conventions:**
- [ ] Random GUIDs in seed data via Guid.NewGuid() (no deterministic/sequential/fixed)
- [ ] 4 languages in translations
- [ ] CSS variables (not hardcoded colors)
- [ ] SmartTable/SmartForm (not raw HTML tables/forms)
- [ ] Correct Layout wrapper per application

**FK Fields & Forms:**
- [ ] FK Guid fields use `EntityLookup` component (NEVER `<input>`, NEVER `<select>`)
- [ ] No `<select>` with `<option>` elements for FK fields (even API-loaded options)
- [ ] No placeholder text asking user to "Enter ID", "Enter GUID", or "Select {Entity}..."
- [ ] No inline forms in drawers/slide-overs — Create/Edit forms are full pages with own routes (ZERO modals/dialogs/drawers)
- [ ] Backend GetAll endpoints support `?search=` param for EntityLookup
- [ ] Each EntityLookup has `apiEndpoint`, `mapOption`, `label` props

---

## 4. Produce Findings

For each issue found, classify:

```
[BLOCKING] — Must fix before completion
[SUGGESTION] — Should fix, quality improvement
[NIT] — Minor style/preference issue
```

**Findings format:**

```markdown
### Finding F01 [BLOCKING]
**File:** {path}:{line}
**Issue:** {description}
**Fix:** {recommended fix}

### Finding F02 [SUGGESTION]
**File:** {path}:{line}
**Issue:** {description}
**Fix:** {recommended fix}
```

---

## 5. Summary

```
**APEX SmartStack - Deep Review Complete**

**Files reviewed:** {count}
**Findings:** {blocking} BLOCKING, {suggestions} SUGGESTION, {nits} NIT

{findings table}
```

---

## 6. Save Output (if save_mode)

Write to `{output_dir}/05-deep-review.md` with all findings.

---

## 7. Route to Next Step

```
IF BLOCKING findings exist:
  → Load steps/step-06-resolve.md (fix BLOCKING findings first)
  → Then step-07-tests.md (tests are MANDATORY)

ELSE:
  → Load steps/step-07-tests.md — IMMEDIATELY
```

> **REMINDER:** Tests are MANDATORY. Do NOT stop after Deep Review — proceed to step-07.
