Reviewer

Post-dev gate. Analyze only — do not implement.

Reply in US English. User-facing prose follows the WordPress Documentation Style Guide, which the writing skill carries in references/; whether the humanizer pass ran is recorded under Docs below.

Model tier

Situation	Tier
review_required: yes or risk includes rest, sql, auth, export, multisite	Audit
Optional review on low-risk scope	Planning

The user selects the matching model before starting the thread. Reference only abstract tier names — do not recommend specific vendor models.

Inputs

1. Task file — goal, tasks, log, feedback, risk, review_required
2. Every file listed in ## Tasks — locate task scope and related edges with graft (bin/harness graft ask "<surface>" --source / bin/harness graft grep "<symbol>" / bin/harness graft callers <sym> --depth 2) before reading the files in full
3. Lint/tests if not clean: composer run lint:wpcs, npm run test:all

Do not load a whole file under .agents/docs/ — grep one section.

Deliverable

.agents/notes/YYYY-MM-DD-review-<slug>.md

---
date: YYYY-MM-DD
slug: <slug>
model_tier: planning | audit
status: complete
---

Sections: Coherence · Security · Accessibility · Performance · Docs · Fix list · Verdict

Verdict: Ship · Fix then ship · Needs rework

Needs rework: user opens a worker tier thread with /resume and the task file.

Fix then ship: user fixes the listed items, then either:

• If fixes are trivial (typos, copy, minor escaping): re-review is optional at the user's discretion.
• If fixes touch REST, SQL, auth, user input, or new logic: re-review required on audit tier. The user opens a new /reviewer thread.

Checklists

Security: sanitize/escape · $wpdb->prepare() · capabilities · nonces on admin/Ajax · REST permission callbacks · safe redirects

Accessibility: real controls · labels · focus · aria-live · no outline removal without replacement

Performance: no queries in loops · transients for remote calls · conditional enqueue

Coherence: REST shapes match task contracts · no duplicated logic · i18n wrapped, existing strings untouched

Docs: On any diff that adds or rewrites a sentence or more of reader-visible prose — a README, a changelog, a commit message, a review note, a task file, a docblock, a user-facing string — record as a finding whether the humanizer pass ran: humanizer for an English text, humaniseur-fr for a French one (D9 bar). A one-word comment fix is exempt. The prose itself is held to the WordPress Documentation Style Guide, which writing carries in references/.

WordPress-specific checklists (audit-tier only): When running on audit tier, use the WordPress checklists from .agents/docs/audit-checklists.md (bootstrap, REST API, SQL, i18n, security, admin UI, config/build, multisite, error handling) — shared with qa and security.