PMA Code Review

• local diff review before commit or merge
• pull request review for changed lines and surrounding context
• repository-wide audit of an existing codebase
• PMA-managed repositories that want stack-aware review, not generic checklist spam

Scope

• shared review policy
• TypeScript frontend review
• TypeScript backend / Bun review
• Go review
• Rust review
• Python review

Quick Start

/pma-cr

/pma-cr <PR-number-or-URL>

/pma-cr audit
/pma-cr repo
/pma-cr --repo

Workflow

1. Detect review mode:
   • no argument: local diff review
   • PR number or URL: PR review

   • audit

     ,

     repo

     , or

     --repo

     : repository audit
2. Read

   references/core-review-policy.md

   .
3. For repository audit, also read

   references/repository-audit.md

   .
4. Detect stack from changed files and project manifests.
5. Read only the matching stack packs:

   • references/typescript-frontend.md

   • references/typescript-backend.md

   • references/go.md

   • references/rust.md

   • references/python.md

6. Review changed code plus the minimal surrounding context required to verify behavior.
7. Report only issues that are likely real and introduced by the change, or for repository audit, issues that are evidenced by current repository code.

Stack Selection

• TypeScript frontend:

  tsx

  , React, Next.js, Vite, routing, UI components, browser state, client forms
• TypeScript backend / Bun: Hono, Express, Fastify, Nest, Bun server code, API routes, DB access, workers
• Go:

  go.mod

  ,

  *.go

• Rust:

  Cargo.toml

  ,

  *.rs

• Python:

  pyproject.toml

  ,

  setup.py

  ,

  requirements.txt

  ,

  *.py

Review Priorities

1. Correctness and regressions
2. Security and trust boundaries
3. Data integrity and error handling
4. Concurrency, cancellation, and resource lifetime
5. Performance and scalability
6. Maintainability and tests

Local Review Mode

• inspect staged and unstaged diffs
• read enough surrounding code to validate behavior
• produce a findings-first report ordered by severity
• block approval for critical issues

PR Review Mode

• inspect PR metadata and diff with

  gh

• skip ineligible PRs such as closed or draft PRs
• gather relevant

  CLAUDE.md

  /

  AGENTS.md

  guidance
• review only changed behavior and nearby context, not unrelated legacy code
• when useful, split the audit by concern or stack, then merge only high-confidence findings
• post review to GitHub via

  gh pr review

  — request changes when issues found, approve when clean

Repository Audit Mode

• inventory manifests, entry points, CI, tests, and stack markers
• identify hotspot areas such as auth, API edges, DB access, jobs, filesystem, external calls, config loading, and isolated dead code
• inspect the highest-risk modules first
• deduplicate findings by root cause, not by file count
• separate confirmed findings from coverage gaps and suggested next actions

Output Rules

• prioritize issues that can break behavior, security, correctness, or operations
• skip issues that linters, compilers, or typecheckers already guarantee
• skip unchanged legacy problems unless the change makes them worse or exposes them
• consolidate repeated instances into one finding when the root cause is shared

• severity
• file and line
• issue
• fix direction

• findings grouped by

  P0

  to

  P3

• affected areas
• issue and impact
• dead-code findings
• dead-code removal candidates
• needs runtime verification
• coverage gaps
• recommended next actions

Reference Packs

• references/core-review-policy.md

  : confidence filter, severity policy, shared review heuristics

• references/repository-audit.md

  : repository-wide audit workflow, hotspot selection, and report structure

• references/typescript-frontend.md

  : React / Next.js / Vite / browser UI review rules

• references/typescript-backend.md

  : Node / Bun / API / validation / DB / async review rules

• references/go.md

  : Go review rules around context, errors, concurrency, HTTP, and resource safety

• references/rust.md

  : Rust review rules around panic boundaries, async blocking, unsafe, docs, and API contracts

• references/python.md

  : Python review rules around validation, deserialization, async, type safety, and command injection