/cc-quality:review {target} [--options]

## Suppressed (3 items excluded)
- [Readability] `*.g.dart` generated code pattern (suppression: code generation related)
- [Performance] const not applied (suppression: style/convention related)
- [Architecture] melos import path (suppression: project structure related)

## Summary

**Overall**: ⭐⭐⭐☆☆ (3/5)    < !-- any UNVERIFIED row caps Overall below 4/5 -- > 

 | Category | Score | Evidence (what actually ran) | Key Issues |
|----------|-------|------------------------------|------------|
| Architecture | ✅ | `serena find_referencing_symbols LoginRepository` → 6 refs, layer order intact | - |
| State Management | ⚠️ | `melos run analyze` → 0 issues; 4 BlocSignalBuilder sites read | BlocSignalBuilder optimization needed |
| Security | ✅ | `grep -rn  " apiKey\|secret "   --include= " *.dart "   lib/` → 0 hits outside Envied | - |
| Performance | ⚠️ | 3 Image widgets read in diff | Image cache size not specified |
| Testing | ❌ | `melos run test` → 118 passed, 0 failed; 0 tests for LoginUseCase | UseCase tests missing |
| Readability | ✅ | `melos run lint:check` → 0 issues | - |
| i18n | ⚠️ UNVERIFIED | Context7 unavailable — pluralization rules not checked | not judged |
| Accessibility | ⚠️ | 2 IconButton without semanticLabel | Some semantic labels missing |
| Structural Failure Modes | ⚠️ | Exhaustiveness block below (18/18 call sites) | New endpoint method has no authorization guard |

### Unverified ⚠️ (1 category — gate BLOCKED unless `--allow-unverified`)

| Category | Why undetermined | What would resolve it |
|----------|------------------|-----------------------|
| i18n | MCP (Context7) unavailable | re-run with Context7, or review pluralization manually |

### Critical Issues 🔴

1. **[Security]** API key hardcoded
   - File: `lib/core/config.dart:15`
   - Fix: Use environment variables via Envied

### Improvements 🟡

1. **[Performance]** Image cache size needs to be specified
   - File: `lib/presentation/widget/product_card.dart:42`
   - Recommended: Add `cacheWidth: 200`

### Suggestions 🟢

1. **[Readability]** Variable name improvement suggestion
   - `data` → `userProfile`

### Exhaustiveness (mandatory whenever §9 flags a call-site family)

| Search command (re-runnable verbatim) | Hits | Checked | Remainder → tracked as |
|---------------------------------------|------|---------|------------------------|
| `grep -rn  " allowMultiple "   --include= " *.dart "   .` | 18 | 18 | 0 |
| `grep -rn  " unawaited( "   --include= " *.dart "   .` | 11 | 9 | 2 → #7746 |

### Suppressed (N items excluded)
 >   Items excluded by suppression rules. Use `--no-suppress` to see all.

## Code Review Gate Result

**Status**: ✅ PASS / ❌ BLOCKED  (PASS requires Critical 0 **and** Unverified 0)

### Category Coverage (9/9 — mapping is mandatory, also in single-reviewer runs)

| # | Category | Reviewer | Score | Evidence (what actually ran) |
|---|----------|----------|-------|------------------------------|
| 1 | Architecture | teammate-2 | ✅ | `serena find_referencing_symbols` → 6 refs |
| 2 | State Management | teammate-2 | ⚠️ | 4 BlocSignalBuilder sites read |
| 3 | Security | teammate-1 | ✅ | `grep -rn  " apiKey\|secret " ` → 0 hits |
| 4 | Performance | teammate-1 | ⚠️ | 3 Image widgets read |
| 5 | Testing | lead | ⚠️ UNVERIFIED | `melos run test` not run (`--quick`) |
| 6 | Readability | teammate-3 | ✅ | `melos run lint:check` → 0 issues |
| 7 | i18n | teammate-3 | ✅ | 0 hardcoded strings in diff |
| 8 | Accessibility | teammate-3 | ⚠️ | 2 IconButton without semanticLabel |
| 9 | Structural Failure Modes | lead | ⚠️ UNVERIFIED | no owner assigned in the split |

### Unverified (Pass 0) ⚠️
 >   Blocks the gate. `undetermined` is not a pass.

| # | Category | Why undetermined | Durable record |
|---|----------|------------------|----------------|
| 1 | Testing | `--quick` skipped `melos run test` | PR body (required if `--allow-unverified`) |
| 2 | Structural Failure Modes | no reviewer owned it in the 3-way split | PR body (required if `--allow-unverified`) |

### Critical Issues (Pass 1) 🔴
 >   Issues that block PR creation

| # | Category | Issue | File | Auto-fix |
|---|----------|-------|------|----------|
| 1 | Security | API key hardcoded | config.dart:15 | ✅ Possible |

### Informational (Pass 2) 📋
 >   Improvement suggestions to include in PR body

| # | Category | Issue | File |
|---|----------|-------|------|
| 1 | Performance | Image cache not specified | product_card.dart:42 |

### Summary
- Categories: 9/9 judged, 2 UNVERIFIED
- Critical: 0 items (after full-diff re-check)
- Unverified: 2 categories → ❌ Gate BLOCKED (`undet:fail`) — pass `--allow-unverified` to proceed
- Informational: 3 items → Included in PR body
- Suppressed: 2 items → Excluded (applied once, after merge)
- Verdict: Critical 0  & &   Unverified 2 → ❌ BLOCKED

RV0    ACT   load suppression list (plugin → project)   reads:cc-quality/rules/suppression.md,.code-review-suppress.md
RV1    LOOP  nine-category sweep (§1..§9)              contract:L-review.nine-category-sweep
RV1.9  LOOP  sibling call-site sweep (§9)              contract:L-review.sibling-callsite-sweep
RV2    JOIN  consolidation (dedup → suppress → recheck) mode:barrier  because:a cross-cutting Critical cannot be judged per category — judge once over the merged set
RV3    GATE  verdict                                   verdict:criticalCount===0  & &   unverifiedCount===0  undet:fail  fail:RVfix
RV4    ACT   emit report + gate tables                 writes:stdout,prBodyExtras.reviewFindings
RVfix  LOOP  caller autofix ↺ re-review                contract:L-review.gate-autofix-recheck  extern:true  tier:standard

RV0 -- >   RV1 -- >   RV1.9 -- >   RV2 -- >   RV3 -- >   RV4
RV3 ~~ >   RV4    on:--allow-unverified                  record:Unverified table in the PR body (console is not durable)
RV3 == >   RVfix  on:criticalCount > 0||unverifiedCount > 0  bound:2  invalidates:RV1,RV1.9,RV2

inv:      each of §1..§9 holds exactly one summary row with BOTH Score and Evidence filled,
          checked on iteration entry and exit; a missing row is UNVERIFIED, never a pass
prog:     judged = categories carrying a Score, strictly increasing 0 → 9
          no-prog: never re-sweep a category without new evidence — mark it UNVERIFIED and move
          on instead of spending the remaining budget on the same category
term:     judged === 9   (9 is defined by `## Review Categories`; not redefined here)
budget:   9 category passes, 1 each. `--focus X` = 1 deep pass + the other 8 marked UNVERIFIED
          (never silently skipped); `--quick` reduces pass DEPTH, never the COUNT
exhaust:  any category still unjudged → `⚠️ UNVERIFIED` and RV3 blocks; promoting it to ✅ is
          prohibited
resume:   the summary table is the position record — rows already holding Score+Evidence are not
          re-run; re-running a category is idempotent (same `file:line + rule-class` merges at RV2)
log:      one line per category, e.g.  " §4 Performance: 2 findings (evidence: 3 Image widgets read) " ,
          plus the UNVERIFIED list; a 0 is printed together with the evidence that produced it

inv:      the recorded search command is re-runnable verbatim and its own count equals the
          reported Hits, on entry and exit
prog:     unchecked = Hits - Checked, strictly decreasing
          no-prog: never re-inspect a site without emitting a verdict for it → Rung 2
term:     unchecked === 0 || every remaining site is covered by a tracked issue id
budget:   1 sweep per changed API/parameter per review; Hits  >   20 → hand the family to
          `plugins/cc-dev/skills/discovery-audit/SKILL.md` instead of extending this sweep
exhaust:  a remainder with no tracked issue id keeps the §9 row 🔴 Critical — never downgraded to
          🟡, never closed as  " out of scope "   in prose
resume:   the previous report ' s Exhaustiveness block (command + Hits + Checked + remainder)
log:      one line per sweep:  " §9.2 allowMultiple → 18 hits / 18 checked / 0 left "

inv:      every re-check re-runs the FULL nine-category sweep against the FULL diff — not only the
          files the autofix touched; suppression is applied once, after the merge, and counted once
prog:     blocking = criticalCount + unverifiedCount, strictly decreasing per attempt
          no-prog: if the same `file:line + rule-class` is still Critical after an attempt, stop
          autofixing that key and escalate (Rung 2 — `/cc-dev:unstuck`); do not spend the second
          attempt on the same key
term:     criticalCount === 0  & &   unverifiedCount === 0
          (or `--allow-unverified` with every unverified category listed in the PR body)
budget:   inner 2 autofix attempts per gate entry / outer 1 re-entry per push
          (how the number is chosen: `plugins/cc-dev/skills/job-timeout-budget/SKILL.md`)
exhaust:  BLOCKED — block PR creation and report the surviving keys.  " warn and continue "   is
          prohibited, as is downgrading a Critical to Informational to reach 0
resume:   the last gate output ' s Critical + Unverified tables, keyed by `file:line + rule-class`;
          re-running the review is idempotent
log:      one line per attempt,  " autofix #2: critical 3→1 unverified 0 " , plus a durable record of
          what was dropped and why (fixed / suppressed / deferred with issue id)

# Lint check
melos run analyze
melos run lint:check

# Test execution
melos run test
melos run test:with-html-coverage

# Formatting (kobic uses dcm format, not dart format)
melos run format

/cc-quality:review feature/auth/lib/src/presentation/bloc/login_bloc.dart

/cc-quality:review feature/auth/ --focus security

/cc-quality:review . --quick