Claude — Code Reviewer Sub-Agent

Six layers. (1) Style: phpcs --standard=Magento2 on changed files. (2) Static analysis: phpstan --level=6. (3) EQP: no ObjectManager in non-setup code, no vendor edits, plugins over preferences, service contracts over direct model access, _isAllowed() on every admin controller. (4) Security: SQL concatenation, unescaped phtml output, missing CSRF, hardcoded secrets. (5) Performance: n+1 queries (look for ->load() in a foreach), missing indexes on new db_schema.xml tables, missing cache tags on blocks. (6) Marketplace: composer.json license, README presence, no GPL deps. Output is a categorised Markdown report — same shape as a GitHub review comment.

From inside Claude Code: /review or explicitly Task tool with subagent_type: code-reviewer and the diff URL or branch name. From CI: a GitHub Action that runs claude code -p "review this diff: $DIFF" --agent code-reviewer and posts the output as a PR comment. The agent reads the diff, the changed files in full context, and your CLAUDE.md — it does not read the entire repo, which keeps the cost predictable. Typical run: 30–60 seconds for a small PR (1–5 files), 2–3 minutes for a large one (20+ files).

Treat the reviewer's report as a draft, not a verdict. Three calibration moves. (1) Add a ## Project conventions section to your CLAUDE.md listing exceptions ("ObjectManager is allowed in Test/Unit — mocks need it"). (2) For repeated false positives, add an .claude/agents/code-reviewer.md override that explicitly mentions the convention. (3) If a finding is genuinely wrong, reply in-thread — the reviewer will adjust within the session. After two weeks of use, the false-positive rate is < 5%; on day 1 it'll be 20%. Patience pays.

About 80% of them, yes — the deterministic ones. Things it catches reliably: vendor edits, raw SQL, deprecated APIs (anything in @deprecated blocks across vendor/magento/*), missing service contracts, hardcoded URLs, missing translations on user-facing strings, missing composer.json dependencies, license file mismatches. Things it can't predict: subjective UX issues, regional compliance flags (GDPR, ADA), and Marketplace-listing copy. For those you still need a human reviewer (hire one). But shipping a PR with zero deterministic findings means the human review is fast and pleasant instead of soul-crushing.

Edit .claude/agents/code-reviewer.md. Add a ## Org-specific rules section with concrete prohibitions: "No new dependencies in composer.json without architecture-team approval. All new admin controllers must extend Vendor\Common\Controller\Adminhtml\Base. All new emails must use the Vendor_Email template loader, not Magento_Email." The agent treats these the same as the built-in EQP rules. For pattern-based rules (regex matches) that the model would miss, add a PostToolUse hook that runs a literal grep and feeds findings back. Treat the code-reviewer.md file as living documentation — it is the source of truth for what "shippable" means in your org.