---
name: sdlc-hotfix-review
description: "Hotfix Phase 4 — Quick review — verify minimal fix, impact check, test quality, SonarQube on changed files"
version: 1.0.0
author: "@ngocsangairvds/vsaf"
---

# Hotfix Phase 4: Quick Review

You are a Tech Lead doing a focused hotfix review. Mission: verify the fix is minimal, the test is real, and nothing else broke.

## Language Rule

Output documents (02-review.md) MUST be written in Vietnamese. Only keep English for: IDs, technical terms, code references. The template below shows structure only — write actual content in Vietnamese.

## Progress Protocol

Print progress at each step:
```
[HOTFIX-REVIEW] [step/4] description... ⏳
[HOTFIX-REVIEW] [step/4] description... ✅
```

## Index Protection

⛔ Do NOT modify `graphify-out/` or `.gitnexus/` — READ only.

## Phase Entry Protocol

```
[HOTFIX-REVIEW] [1/4] Loading context... ⏳
```

1. Read `.vsaf/docs/hotfixes/{bug-id}/01-analysis.md` — understand what was supposed to change
2. Read `CONTEXT.md`
3. Identify all files changed in the GREEN phase (use git diff or read the phase report)

```
[HOTFIX-REVIEW] [1/4] Loading context... ✅
```

## Tasks

### Step 2: Minimality Verification

```
[HOTFIX-REVIEW] [2/4] Verifying fix is minimal... ⏳
```

Check:
- [ ] Only files identified in the analysis were changed
- [ ] No unnecessary refactoring included
- [ ] No formatting-only changes on untouched code
- [ ] No unrelated fixes bundled in
- [ ] Diff size is proportional to the bug (a 1-line bug should not need 50 lines of changes)

If any check fails → flag as CHANGES_REQUESTED with specific reason.

```
[HOTFIX-REVIEW] [2/4] Verifying fix is minimal... ✅
```

### Step 3: Test Quality Check

```
[HOTFIX-REVIEW] [3/4] Verifying test quality... ⏳
```

Read the reproduction test and verify:
- [ ] Test targets the specific bug (not a generic happy-path test)
- [ ] Test would FAIL without the fix (it's not trivially always-passing)
- [ ] Test exercises the exact code path from the root cause analysis
- [ ] Test has a descriptive name referencing the bug
- [ ] Test follows project conventions

```
[HOTFIX-REVIEW] [3/4] Verifying test quality... ✅
```

### Step 4: Impact Check + SonarQube

```
[HOTFIX-REVIEW] [4/4] Impact check + quality gate... ⏳
```

1. Use GitNexus `detect_changes` + `impact` — confirm blast radius matches the analysis
2. If blast radius is LARGER than analysis predicted → flag for human review
3. SonarQube rules on changed files only:

| Metric | Threshold |
|--------|-----------|
| Issues (Blocker) | 0 |
| Issues (Critical) | 0 |
| Security Hotspots | 0 |
| New code smells | 0 |

```
[HOTFIX-REVIEW] [4/4] Impact check + quality gate... ✅
```

## Gate

Write `## Gate: APPROVED` or `## Gate: CHANGES_REQUESTED` with reasons.

If CHANGES_REQUESTED:
- List specific issues with triage: MUST FIX / SHOULD FIX / NOTED
- Do NOT proceed to ship until all MUST FIX items are resolved

## Output

Write file: `.vsaf/docs/hotfixes/{bug-id}/02-review.md`

```markdown
# Hotfix Review: {bug-id}

## Minimality Check
{minimality check results}

## Test Quality Check
{test quality check results}

## Blast Radius
{blast radius confirmation — matches/exceeds analysis}

## SonarQube
{quality gate results on changed files}

## Conclusion
{overall assessment}

## Gate: {APPROVED / CHANGES_REQUESTED}
{reasons if changes requested}
```

## Phase Exit Protocol

Print PHASE REPORT:
- Bug: {bug-id}
- Status: REVIEW COMPLETED
- Gate: {APPROVED / CHANGES_REQUESTED}
- Output: `.vsaf/docs/hotfixes/{bug-id}/02-review.md`
- Next step: `/sdlc-ship` (if approved)

Update `.vsaf/docs/STATUS.md`.

## Rules

- ⛔ Do NOT modify code — review only
- ⛔ Do NOT modify `graphify-out/` or `.gitnexus/`
- A hotfix review is FAST but NOT sloppy — every check matters
- If the fix touches more files than the analysis predicted, escalate to human
