---
name: step-05-deep-review
description: Adversarial code review of changes — find issues before they reach production
model: opus
prev_step: steps/step-04-examine.md
next_step: steps/step-06-resolve.md
---

# Step 5: Deep Review (if -x)

**Goal:** Review the code as an adversarial external reviewer. Find bugs, security issues, and convention violations that the automated eXamine checks (step-04) missed.

---

## 0. Task Progress

### Progress Tracker Update
```
TaskUpdate(taskId: progress_tracker_id,
  description: "Module: {module_code}. Current: step-05 (Deep Review)",
  activeForm: "Reviewing code")
```

---

## 1. Gather Changed Files

```bash
git diff --name-only HEAD~{commit_count}
```

List all files modified during this APEX session.

---

## 2. MCP Code Review

```
Call: mcp__smartstack__review_code
  scope: "changed"      # Only review files changed in this session

Call: mcp__smartstack__analyze_code_quality
  scope: "changed"
```

---

## 3. Manual Adversarial Review

For each changed file, check:

**Security (OWASP):**
- [ ] Require `[RequirePermission]` on every endpoint (not `[Authorize]`)
- [ ] Verify no SQL injection (parameterized queries, EF Core only)
- [ ] Check no XSS (React auto-escapes, but verify dangerouslySetInnerHTML)
- [ ] Confirm multi-tenant isolation (IHasData filter applied)
- [ ] Ensure no secrets in code

**Architecture:**
- [ ] Entities in correct Domain folder
- [ ] Configs in correct Infrastructure folder
- [ ] Services follow CQRS pattern
- [ ] DTOs separate from domain entities
- [ ] Controllers return DTOs, not entities
- [ ] Frontend in correct hierarchy (App/Module)

**SmartStack conventions:**
- [ ] Seed data GUIDs via Guid.NewGuid() (see core-seed-data.md §1b)
- [ ] 4 languages in translations
- [ ] CSS variables only (see smartstack-frontend.md §4)
- [ ] DataTable (not raw HTML `<table>`) and concrete form markup (not non-existent SmartForm)
- [ ] Correct Layout wrapper per application

**FK Fields & Forms:**
- [ ] FK Guid fields use `EntityLookup` component (do not use `<input>` or `<select>`) (see smartstack-frontend.md §6)
- [ ] Verify no `<select>` with `<option>` elements for FK fields (even API-loaded options)
- [ ] Ensure no placeholder text asking user to "Enter ID", "Enter GUID", or "Select {Entity}..."
- [ ] Verify no inline forms in drawers/slide-overs; Create/Edit forms are full pages with own routes (zero modals/dialogs/drawers) (see smartstack-frontend.md §3b)
- [ ] Confirm backend GetAll endpoints support `?search=` param for EntityLookup
- [ ] Verify each EntityLookup has `apiEndpoint`, `mapOption`, `label` props

---

## 4. Produce Findings

For each issue found, classify:

```
[BLOCKING] — Must fix before completion
[SUGGESTION] — Should fix, quality improvement
[NIT] — Minor style/preference issue
```

**Findings format:**

```markdown
### Finding F01 [BLOCKING]
**File:** {path}:{line}
**Issue:** {description}
**Fix:** {recommended fix}

### Finding F02 [SUGGESTION]
**File:** {path}:{line}
**Issue:** {description}
**Fix:** {recommended fix}
```

---

## 5. Summary

```
**APEX SmartStack - Deep Review Complete**

**Files reviewed:** {count}
**Findings:** {blocking} BLOCKING, {suggestions} SUGGESTION, {nits} NIT

{findings table}
```

---

## 6. Save Output (if save_mode)

Write to `{output_dir}/05-deep-review.md` with all findings.

---

## 7. Route to Next Step

```
IF BLOCKING findings exist:
  → Load steps/step-06-resolve.md (fix findings first)
  → Then step-07-tests.md (tests are required)

ELSE:
  → Load steps/step-07-tests.md — IMMEDIATELY
```

Tests are required. Do not stop after Deep Review — proceed to step-07.
