review

Review Orchestrator

The single entry point for application reviews. It triages what matters, then runs one or more domain reviews and merges them into a unified report. Each domain lives in references/<domain>.md and is loaded only when selected.

When to use

User wants a review but isn't sure which kind
Pre-launch readiness assessment
Post-incident review planning
A targeted request for one domain ("check my app's security", "review SEO")

Modes

Triage (default, /review) — ask context questions, recommend a plan, run it.
Full suite (/review --all) — run every applicable domain.
Targeted (/review <domain>) — jump straight into one domain, skipping triage. E.g. /review security, /review seo. Accepts an optional depth flag (--quick / --thorough).

Domains

Each row maps to a reference file. Load the file only when the domain is selected.

Domain	Reference	Run it when… (trigger signals)
security	`references/security.md`	auth/login changes, sensitive data, OWASP, headers/CORS/CSP, supply chain
privacy	`references/privacy.md`	collects PII, tracking/analytics, consent banners, GDPR/CCPA
compliance	`references/compliance.md`	regulated industry, audit prep, HIPAA/SOC 2/PCI-DSS/GDPR, payments or health data
design	`references/design.md`	UI shipping without a designer, responsive, accessibility, typography, i18n
resilience	`references/resilience.md`	error handling, network/API failures, empty/edge states, degradation
performance	`references/performance.md`	slow pages, Core Web Vitals, bundle size, runtime/render perf
seo	`references/seo.md`	public site, meta tags, structured data, crawlability, sitemaps
geo	`references/geo.md`	discovered via AI assistants, LLM citation readiness, llms.txt, entity clarity

Shared conventions (phases, scoring, confidence, severity, output paths) live in references/report-format.md — every domain follows them.

Steps

1. Gather context

Read the project: tech stack, framework, package.json, routes, components.
Check git diff for recent changes.
Look for existing reports in shiplight/reports/.
Auto-detect compliance markers (HIPAA/PHI, PCI/payment fields, GDPR/cookie consent).

If invoked as /review <domain>, skip to step 4 for that domain.

2. Ask targeted questions (max 4)

One at a time, with auto-detected defaults:

What type of application? (SaaS, healthcare, fintech, e-commerce, internal tool, marketing site, API-only)
What triggered this review? (pre-launch, new feature, dependency update, security incident, audit prep, routine)
Any compliance requirements? (none, HIPAA, SOC2, PCI-DSS, GDPR, multiple) — auto-detect from codebase
Specific concerns? (open-ended, optional)

3. Generate review plan

Categorize each applicable domain as CRITICAL (must run), RECOMMENDED (meaningful value), or OPTIONAL (nice to have), with estimated depth (quick / standard / thorough).

SEO vs GEO prioritization by product type:

Product type	SEO	GEO
Developer tools, API products, SaaS	RECOMMENDED	CRITICAL
E-commerce, local business, marketplace	CRITICAL	OPTIONAL
Content/media, documentation, blog	CRITICAL	CRITICAL
Internal tools	—	—

Present a decision matrix:

Review	Priority	Rationale	Depth
security	CRITICAL	New auth feature + SaaS app	thorough
privacy	CRITICAL	Handles user PII, GDPR applies	standard
…

4. Execute

Ask: "Run all CRITICAL reviews now? [Y/n] Or pick specific ones."

For each selected domain, read references/<domain>.md and follow its five phases, applying references/report-format.md for scoring, severity, and output paths. Run domains sequentially; show a brief summary after each before moving on.

5. Unified report

After the selected domains complete, merge their per-domain reports into one, saved to shiplight/reports/review-{date}.md:

Overall readiness score (0–10) and per-domain scores
Top 5 findings across all domains, by severity
Regression test summary (total YAML tests generated, in shiplight/tests/)

Tips

Run /review before every major launch.
/review <domain> is the fast path when you already know what you need.
Reports accumulate in shiplight/reports/ — the orchestrator can show trends.
YAML regression tests from reviews accumulate in shiplight/tests/.