review

Review Orchestrator

The single entry point for application reviews. It triages what matters, then runs one or more domain reviews and merges them into a unified report. Each domain lives in references/<domain>.md and is loaded only when selected.

When to use

• User wants a review but isn't sure which kind
• Pre-launch readiness assessment
• Post-incident review planning
• A targeted request for one domain ("check my app's security", "review SEO")

Modes

• Triage (default, /review) — ask context questions, recommend a plan, run it.
• Full suite (/review --all) — run every applicable domain.
• Targeted (/review <domain>) — jump straight into one domain, skipping triage. E.g. /review security, /review seo. Accepts an optional depth flag (--quick / --thorough).

Domains

Each row maps to a reference file. Load the file only when the domain is selected.

Domain	Reference	Run it when… (trigger signals)
security	references/security.md	auth/login changes, sensitive data, OWASP, headers/CORS/CSP, supply chain
privacy	references/privacy.md	collects PII, tracking/analytics, consent banners, GDPR/CCPA
compliance	references/compliance.md	regulated industry, audit prep, HIPAA/SOC 2/PCI-DSS/GDPR, payments or health data
design	references/design.md	UI shipping without a designer, responsive, accessibility, typography, i18n
resilience	references/resilience.md	error handling, network/API failures, empty/edge states, degradation
performance	references/performance.md	slow pages, Core Web Vitals, bundle size, runtime/render perf
seo	references/seo.md	public site, meta tags, structured data, crawlability, sitemaps
geo	references/geo.md	discovered via AI assistants, LLM citation readiness, llms.txt, entity clarity

Shared conventions (phases, scoring, confidence, severity, output paths) live in references/report-format.md — every domain follows them.

Steps

1. Gather context

• Read the project: tech stack, framework, package.json, routes, components.
• Check git diff for recent changes.
• Look for existing reports in shiplight/reports/.
• Auto-detect compliance markers (HIPAA/PHI, PCI/payment fields, GDPR/cookie consent).

If invoked as /review <domain>, skip to step 4 for that domain.

2. Ask targeted questions (max 4)

One at a time, with auto-detected defaults:

1. What type of application? (SaaS, healthcare, fintech, e-commerce, internal tool, marketing site, API-only)
2. What triggered this review? (pre-launch, new feature, dependency update, security incident, audit prep, routine)
3. Any compliance requirements? (none, HIPAA, SOC2, PCI-DSS, GDPR, multiple) — auto-detect from codebase
4. Specific concerns? (open-ended, optional)

3. Generate review plan

Categorize each applicable domain as CRITICAL (must run), RECOMMENDED (meaningful value), or OPTIONAL (nice to have), with estimated depth (quick / standard / thorough).

SEO vs GEO prioritization by product type:

Product type	SEO	GEO
Developer tools, API products, SaaS	RECOMMENDED	CRITICAL
E-commerce, local business, marketplace	CRITICAL	OPTIONAL
Content/media, documentation, blog	CRITICAL	CRITICAL
Internal tools	—	—

Present a decision matrix:

Review	Priority	Rationale	Depth
security	CRITICAL	New auth feature + SaaS app	thorough
privacy	CRITICAL	Handles user PII, GDPR applies	standard
…

4. Execute

Ask: "Run all CRITICAL reviews now? [Y/n] Or pick specific ones."

For each selected domain, read references/<domain>.md and follow its five phases, applying references/report-format.md for scoring, severity, and output paths. Run domains sequentially; show a brief summary after each before moving on.

5. Unified report

After the selected domains complete, merge their per-domain reports into one, saved to shiplight/reports/review-{date}.md:

• Overall readiness score (0–10) and per-domain scores
• Top 5 findings across all domains, by severity
• Regression test summary (total YAML tests generated, in shiplight/tests/)

Tips

• Run /review before every major launch.
• /review <domain> is the fast path when you already know what you need.
• Reports accumulate in shiplight/reports/ — the orchestrator can show trends.
• YAML regression tests from reviews accumulate in shiplight/tests/.