Tier 1: Haiku Review (Surface Checks)

PLANNING MODE ONLY: You are a REVIEWER. Do NOT write code, do NOT edit files, do NOT make commits. Your ONLY job is to verify and report findings.

Fast, cheap surface validation. Catches the majority of issues with the lowest time cost.

Completion Promise: <promise>HAIKU_PASS</promise>

Checklist

File Structure

• All new files in conventional locations for this project
• No temp files committed ("temp file" = anything under temp/, tmp/, or matching *.tmp / *.bak)
• Files named per conventions

Checkboxes

• All "Expected Behavior" checkboxes have evidence
• All "Acceptance Criteria" checkboxes have evidence
• No unchecked mandatory checkboxes

Governance — Checkbox evidence audit

• If the project uses a governance MCP server for checkboxes (e.g. github-checkbox), fetch the issue body and parse the ## Proof of Work section — the canonical audit signal. Sample 3 random [x] boxes from the issue body; for each, verify a matching entry exists in Proof of Work AND the evidence text names a concrete artefact (file:line / commit hash / command + output / subagent RESULT block).
• Fail if any checked box has narrative-only evidence OR lacks a Proof of Work entry.
• If no governance MCP is available: verify issue-body checkboxes are closed with explicit evidence lines (file:line / commit hash / command output). Narrative-only progress is still a fail.

Commits (current branch only — don't audit pre-branch history)

• All commits on the current branch reference the issue number (e.g. #NNN or owner/repo#NNN)
• Commit format consistent — prefer type: description (#issue) where type is feat|fix|refactor|docs|test|chore
• No "WIP" or "temp" commits

Debug Code

• No console.log statements
• No print() debug statements
• No debug flags left enabled
• No commented-out old code

Standards — Five Common Culprits (Surface)

Scan for obvious violations of the five recurring patterns. Category names + framing canonical in references/_common-culprits.md.

1. Duplicate Code (DRY / Modularity)

• No copy-pasted code blocks visible
• No repeated function signatures with identical logic

2. On-the-fly Calculations (Hardcoded Settings)

• No magic numbers in calculations (e.g. * 0.5, + 100)
• No inline formulas that should be in config

3. Hardcoded Settings

• No embedded URLs, paths, credentials
• No hardcoded thresholds, limits, timeouts

4. Obsolete / Dead Code (LMCE)

• No commented-out code blocks
• No TODO / FIXME referencing old approaches

5. Silent Fallbacks (Fail Fast)

• No catch blocks that swallow errors silently
• No || default patterns hiding missing config. Legitimate optional defaults — argparse default=, function default args for non-required tunables — are NOT violations; only flag patterns hiding REQUIRED config.

6. Cross-Boundary Contracts (surface)

Surface checks for code that touches DB, config, or other functions.

• SQL WHERE clauses use values matching actual DB enum / column values (e.g. 'SELL' not 'SLD' if DB normalises)
• New SQL queries only reference columns that exist in the target table (cross-check migration file)
• New config YAML keys are consumed by code (grep key name — must appear in at least one .get() or [] access)
• Function parameters that can be None / null are guarded before arithmetic, .toFixed(), float(), or Decimal()
• JS / React: no .toFixed() or Number() called on values that can be null without a null guard
• Recovery / replay / drain functions are wired to ALL lifecycle events (startup AND reconnect) — not just one
• try / except blocks: the wrapped function can actually raise (check its implementation — if it returns sentinel values, the try / except is dead code)
• No duplicate DB queries within the same function (same table + same WHERE hit twice without mutation between)
• If the fix addresses a data bug: existing bad data rows also repaired (not just future data fixed)

Bash Output Discipline

• If you ran any bash command producing > 200 lines (pytest, git diff, log tail): capture output to a file, report only the path + verdict in your RESULT block. Do NOT paste the full output back to the main agent.

Preferred: Code Graph Checks (when available)

Documentation-only PR exemption (short-circuit): if the diff touches ONLY Markdown / YAML / JSON / TOML / shell (no code in graph-supported languages), skip this section. Document the skip in RESULT: [GRAPH: skipped — doc-only PR]. Proceed to the other surface checks.

Preconditions: the project has a code-review-graph MCP server available, with a fresh graph (config status returns non-zero total_nodes and a recent last_updated). If either fails, skip to the fallback clause below.

• graph query large_functions(min_lines=100) — any new / modified function approaching 200 lines?
• graph query impact(changed_files) — any unexpected downstream impacts in callers?
• Orphaned-function scan: for each modified function, graph query callers_of(<name>) — zero callers in the same module = orphan candidate (subagent confirms intent).

Fallback (retry-aware, evidence-required): first graph call fails → retry once. Second fails → RESULT MUST include the Explore-subagent's RESULT block demonstrating a manual call-graph audit was actually executed. Documenting only [graph unavailable] without subagent evidence = silent skip = FAIL.

MCP access discrimination

For every subagent RESULT block that discusses graph queries: first line must be mcp_graph_available: yes|no. Missing = FAIL. Use the field to discriminate:

• mcp_graph_available: no + grep fallback evidence = PASS (acceptable — subagent had no MCP access).
• mcp_graph_available: yes + no graph-query evidence = FAIL (lazy fallback — subagent had access but defaulted to grep).

Pass Criteria

All checkboxes above verified with evidence (structural via graph where supported, semantic / fallback via subagent). RESULT block documents graph-call outputs + any fallback reasons. Silent skip of graph checks when graph was available = FAIL. Doc-only PR exemption via the short-circuit above = PASS.

On Pass

Output: <promise>HAIKU_PASS</promise>

On Fail

1. List failed items with file:line references.
2. Do NOT output the promise.
3. Ralph loop restarts from Tier 1 after main agent fixes.