Backend Code Review
Review the requested scope for concrete, reproducible defects. The nearest AGENTS.md owns package facts and commands; this skill owns the review workflow and routes to the shared backend guides in docs/.
Evidence First
- Establish the requested review scope and inspect the relevant diff or files.
- Read the changed lines, their behavior owner, nearby tests, and local docstrings or comments that define contracts.
- Trace callers, persistence boundaries, authorization, generated schemas, or external I/O only when they decide correctness.
- Report only findings tied to an observable failure, violated contract, security boundary, data integrity risk, or demonstrated maintenance problem.
Rule Routing
Read only the guidance matched by the diff:
- Models or migrations: Database schema
- Controllers, application services, ports, adapters, the composition root, import-boundary contracts, libraries, or model behavior: Backend architecture
- Table access outside a repository that implements a consumer-owned port: Repositories
- SQLAlchemy sessions, queries, transactions, CRUD, concurrency, or raw SQL: SQLAlchemy
When no guide applies, review correctness, security, behavior changes, and test evidence directly. Check current official documentation only when local code and contracts do not settle framework or library behavior.
Severity And Output
- P0: security or privacy exposure, data loss, or a production-wide outage.
- P1: user-visible regression, broken authorization or tenant isolation, invalid public contract, or failed primary workflow.
- P2: concrete correctness, performance, maintainability, or test defect likely to cause incorrect behavior.
- P3: minor actionable cleanup; omit unless the user requested a thorough audit.
Lead with findings ordered by severity. Include a tight file and line reference, the failing contract or reproduction path, impact, and a concrete fix direction. If there are no findings, say No issues found. and state any material verification gap. Do not add praise sections, speculative risks, or an unsolicited offer to implement fixes.