AI-Assisted Code Review Checklist

Review the change, not the explanation

Read the governing requirements, then inspect the diff and affected code paths independently of the author's summary. Confirm the change is necessary, complete, minimal, and consistent with local patterns. Trace data, authorization, errors, concurrency, persistence, migrations, compatibility, and user-visible failure behavior where relevant.

AI-generated review comments are candidate findings. Validate each against the actual revision and execution context, remove unsupported claims, and identify material gaps the model did not mention. The change author or an automated reviewer does not replace an authorized independent approver.

Record findings with actionable evidence

Prioritize defects that can change correctness, security, privacy, reliability, accessibility, or recoverability. A useful finding names the affected location, triggering condition, observable impact, evidence, and smallest acceptable correction.

Change and revision: [PR/CHANGE ID, COMMIT]
Acceptance criteria reviewed: [CRITERIA]
Scope check: [EXPECTED FILES, UNEXPECTED FILES]
Behavior traced: [INPUT -> DECISION -> SIDE EFFECT -> OUTPUT]
Security/privacy checks: [AUTH, INPUT, SECRET, DATA, DEPENDENCY]
Failure/retry/recovery checks: [SCENARIOS]
Compatibility/migration checks: [VERSIONS OR NONE]
Tests inspected and rerun: [COMMAND -> RESULT]
Finding: [SEVERITY, FILE/LOCATION, TRIGGER, IMPACT, EVIDENCE, FIX]
AI-suggested findings rejected: [CLAIM -> REASON]
Residual risk: [RISK -> OWNER]
Decision: [APPROVE | COMMENT | REQUEST CHANGES]
Reviewer identity and date: [INDEPENDENT REVIEWER, YYYY-MM-DD]

Expected evidence and verification

The expected evidence is an independent review tied to an immutable revision, with reproducible findings, rerun checks, a disposition for each material risk, and an explicit decision.

After revisions, inspect the new diff instead of assuming comments were resolved, rerun affected checks, and ensure the approval applies to the current head. Do not approve with unresolved critical or high-impact findings. Preserve the review and required approvals in the system of record.