🚫 **SDLC state not found**

No state file at docs/sdlc.state.json.
Run /sdlc:init and /sdlc:plan first to create planning artifacts.

🚫 **Planning not complete**

Missing confirmations:
- [ ] {checkpoint} (status: {status})

Run /sdlc:plan to complete planning first.

# Check for source files
Glob: src/**/*.ts, src/**/*.tsx, app/**/*.ts, app/**/*.tsx

🚫 **No implementation detected**

No source files found. Run /sdlc:implement first to build from planning artifacts.

Read the OpenAPI specification at docs/arch/api/openapi.yaml. For every endpoint defined:

1. Search the codebase for corresponding route handlers
2. Verify the HTTP method matches
3. Check request parameters and body schema
4. Check response schema shape
5. Verify documented status codes are handled
6. Check authentication/authorization requirements

Also search for any route handlers NOT documented in the OpenAPI spec.

Report all findings using the conformance checklist format.

Read the ERD at docs/arch/data-model/erd.mmd and table definitions at docs/arch/data-model/tables.md.
For every entity/table defined:

1. Search for corresponding database schema (Prisma, TypeORM, Drizzle, or raw SQL)
2. Verify all columns exist with correct types
3. Check relationships (foreign keys, joins)
4. Verify constraints (NOT NULL, UNIQUE, CHECK)
5. Check indexes match documented strategy

Also search for any tables/models NOT documented in the ERD.

Report all findings using the conformance checklist format.

Read the class diagram at docs/arch/domain-model/class-diagram.mmd.
For every class/interface defined:

1. Search for corresponding TypeScript class, interface, or type
2. Verify all attributes exist as properties with correct types
3. Check methods are implemented
4. Verify relationships (composition, aggregation, association)
5. Check validation rules from domain model are enforced

Report all findings using the conformance checklist format.

Read user stories from docs/req/user-stories.md. For every acceptance criterion:

1. Search for test files that exercise this feature
2. Find specific test assertions that verify the criterion
3. Check if both happy path and error path are tested
4. Note criteria with no test coverage

Produce a traceability matrix:
| Story ID | Criterion | Test File | Test Name | Status |

Read the threat model at docs/security/threat-model.md and auth design artifacts.
Verify:

1. STRIDE mitigations mentioned in threat model are implemented in code
2. Authentication design (JWT, session, etc.) matches implementation
3. Authorization checks exist on protected routes
4. No hardcoded secrets in source code
5. Input validation present on all user-facing endpoints
6. Security headers configured (CORS, CSP, etc.)

Report findings with severity and file references.

# Design Review Report

**Date**: {YYYY-MM-DD}
**Run ID**: {unique-id}
**Reviewer**: /sdlc:review (automated)

## Executive Summary

**Overall Status**: {PASS | PASS WITH DEVIATIONS | FAIL}

{1-3 sentence summary of key findings}

## Dimension Results

| Dimension | Status | Findings | Critical | Major | Minor |
|-----------|--------|----------|----------|-------|-------|
| API Contract | {PASS/FAIL} | {count} | {count} | {count} | {count} |
| Data Model | {PASS/FAIL} | {count} | {count} | {count} | {count} |
| Domain Model | {PASS/FAIL} | {count} | {count} | {count} | {count} |
| Acceptance Criteria | {PASS/FAIL} | {count} | {count} | {count} | {count} |
| Security | {PASS/FAIL/SKIPPED} | {count} | {count} | {count} | {count} |
| Documentation | {PASS/FAIL} | {count} | {count} | {count} | {count} |

## Detailed Findings

### Dimension 1: API Contract Conformance

{Detailed findings from review-auditor}

### Dimension 2: Data Model Conformance

{Detailed findings from review-auditor}

### Dimension 3: Domain Model Conformance

{Detailed findings from review-auditor}

### Dimension 4: Acceptance Criteria Traceability

{Traceability matrix from domain-analyst}

### Dimension 5: Security Implementation

{Security findings from security-engineer, or "Skipped - security module not active"}

### Dimension 6: Documentation Completeness

{Documentation check results}

## Deviations Catalog

Intentional differences between plan and implementation:

| ID | Artifact | Planned | Actual | Reason | Approved |
|----|----------|---------|--------|--------|----------|
| DEV-001 | {artifact} | {planned} | {actual} | {reason} | {yes/no/pending} |

## Recommended Actions

### Critical (Must Fix)
1. {action with file reference}

### Major (Should Fix)
1. {action with file reference}

### Minor (Nice to Fix)
1. {action with file reference}

---

**Previous Reports**: {list of previous report files, if any}

# Deviations Log

Catalog of approved differences between planning artifacts and implementation.

| ID | Date | Artifact | Planned | Actual | Reason | Status |
|----|------|----------|---------|--------|--------|--------|
| DEV-001 | {date} | {artifact} | {planned} | {actual} | {reason} | Pending Approval |

{
  "review": {
    "status": "completed",
    "lastRun": "YYYY-MM-DDTHH:mm:ss.sssZ",
    "history": [
      {
        "runId": "{unique-id}",
        "timestamp": "YYYY-MM-DDTHH:mm:ss.sssZ",
        "dimensions": {
          "apiContract": { "status": "pass", "findings": 0 },
          "dataModel": { "status": "pass", "findings": 2 },
          "domainModel": { "status": "fail", "findings": 5 },
          "acceptanceCriteria": { "status": "pass", "findings": 1 },
          "security": { "status": "skipped", "findings": 0 },
          "documentation": { "status": "pass", "findings": 3 }
        },
        "overallStatus": "pass_with_deviations",
        "reportPath": "docs/review/review-report-YYYY-MM-DD.md"
      }
    ]
  }
}

cp docs/review/review-report-*.md packages/planning-hub/public/artifacts/review/

## Design Review Complete

**Overall**: {PASS | PASS WITH DEVIATIONS | FAIL}

| Dimension | Status | Findings |
|-----------|--------|----------|
| API Contract | {status} | {count} |
| Data Model | {status} | {count} |
| Domain Model | {status} | {count} |
| Acceptance Criteria | {status} | {count} |
| Security | {status} | {count} |
| Documentation | {status} | {count} |

**Critical findings**: {count}
**Report**: docs/review/review-report-{date}.md

### Actions Needed

{list top 3-5 most important findings}

⚠️ **Cannot run full review**

Missing artifacts:
- {artifact} — needed for {dimension}

Suggestion: Run /sdlc:plan to generate missing artifacts.

Proceeding with available dimensions only.

🚫 **No implementation to review**

No source files detected in the project.

Run /sdlc:implement to create implementation from planning artifacts.

⚠️ **Partial implementation detected**

Reviewing what exists. Unimplemented items will be marked as "Not Started" rather than "Missing".